mergedrop: pin CORS_ORIGINS to app origin (was wildcard)

apps/mergedrop/config.json

@@ -7,7 +7,7 @@
   "port": 8765,
   "id_name": "mergedrop",
   "description": "Self-hosted drag-and-drop video merger. Drop clips, reorder, and build a single MP4 with ffmpeg.",
-  "tipi_version": 4,
+  "tipi_version": 5,
   "version": "1.0.2",
   "dynamic_config": true,
   "supported_architectures": ["amd64"],
@@ -39,5 +39,5 @@
       "env_variable": "MERGEDROP_OUTPUT_MAX_AGE_HOURS"
     }
   ],
-  "updated_at": 1787293276649
+  "updated_at": 1787332264747
 }

apps/mergedrop/docker-compose.json

@@ -16,7 +16,7 @@
         { "key": "MERGEDROP_MAX_FILES", "value": "${MERGEDROP_MAX_FILES}" },
         { "key": "MERGEDROP_MAX_FILE_SIZE", "value": "${MERGEDROP_MAX_FILE_SIZE}" },
         { "key": "MERGEDROP_OUTPUT_MAX_AGE_HOURS", "value": "${MERGEDROP_OUTPUT_MAX_AGE_HOURS}" },
-        { "key": "CORS_ORIGINS", "value": "*" },
+        { "key": "CORS_ORIGINS", "value": "${APP_PROTOCOL}://${APP_DOMAIN}" },
         { "key": "MONGO_URL", "value": "mongodb://mergedrop-db:27017" },
         { "key": "DB_NAME", "value": "mergedrop" }
       ],