Fix CORS Errors on Django

django-cors-headers injects CORS response headers and answers OPTIONS for Django REST Framework and vanilla views. Set CORS_ALLOWED_ORIGINS explicitly in settings instead of turning on CORS_ALLOW_ALL_ORIGINS in production.

Place the middleware high enough that authentication middleware can still run on API routes without breaking preflight. Use environment variables per stage so staging and production origins stay separate.

Cross-check with CORSFixer after deploy.