The errorHandler middleware was not adding CORS headers to error
responses in a production-ready way. This caused browsers to block
client-side applications from reading the response body, resulting in
generic network errors instead of specific API error messages.

This change refactors the errorHandler to use an environment-aware
helper function. It now checks for a `CORS_ALLOWED_ORIGIN` environment
variable for production and falls back to allowing any `localhost`
origin for development. This aligns the error response behavior with
the main CORS middleware and the project's documentation, fixing the bug.

Adds the `CORS_ALLOWED_ORIGIN` environment variable to the example
configuration file. This synchronizes the `.env.example` with the
existing documentation and recent CORS-related code changes, ensuring
developers are aware of this required setting for production deployments.

Adds the `CORS_ALLOWED_ORIGIN` environment variable to the example
configuration file. This synchronizes the `.env.example` with the
existing documentation and recent CORS-related code changes, ensuring
developers are aware of this required setting for production deployments.

Updates the environment variable example in the README.md to match
the format and content of `.env.example`. This change adds comments
explaining each variable and comments them out by default, improving
clarity and ensuring consistency across project documentation.

Updates the comments in the `.env.example` file to be more explicit
and unambiguous. The new comments clearly state when each variable is
required (e.g., "REQUIRED" vs. "REQUIRED FOR PRODUCTION") and provide
better context for their purpose. This resolves confusion around the
previous "Optional for Production" wording.

The errorHandler middleware was missing the `Access-Control-Allow-Credentials`
header in its CORS configuration. This caused browsers to block credentialed
requests (e.g., those with an Authorization header) that resulted in an
error, leading to a specific CORS failure.

This change adds the `Access-Control-Allow-Credentials: true` header to
all error responses when the origin is allowed, resolving the issue and
allowing the client to correctly read API error messages for authenticated
or credentialed requests.

Updates the "Configuration" section in the README.md to be clearer and
more direct. Instead of instructing users to create a .env file from
scratch and duplicating the example content, it now instructs them to
copy the existing `.env.example` file. This removes redundancy and
improves the developer setup experience.