Remove hardcoded domains, lock down CORS, complete the env examples

[Kaushik4141]

apps/api/src/index.ts has https://clerk.vote.dk24.org/__clerk (line 32) and Access-Control-Allow-Origin: https://vote.dk24.org (lines 45 and 64). apps/clerk-proxy/src/index.js:14,32 has the same literals, and its fetch(request) signature needs env added to read them.

• Introduce FRONTEND_URL and CLERK_PROXY_URL as required Worker vars, and use them in both apps
• index.ts:19 is app.use('*', cors()) with no origin restriction — the entire API currently accepts requests from any origin. Lock it to { origin: c.env.FRONTEND_URL, credentials: true }
• wrangler.toml:11 — replace the real database_id with YOUR_D1_DATABASE_ID and document wrangler d1 create
• Fix the DB name mismatch: drizzle.config.ts says voting-system-db, wrangler.toml says vote-system

Env examples are incomplete

• apps/api/.dev.vars.example is missing CLERK_WEBHOOK_SECRET, read at runtime by webhook.Controller.ts
• apps/web/.env.example is missing VITE_CLERK_PROXY_URL, read by main.tsx:13
• Add the two new vars above, each with a one-line comment on where to get it

A deployer following the current examples gets a broken app with no clue why.