fix(security): lock Mux upload CORS origin to the real domain in prod

cors_origin was hardcoded to "*" for all environments. Now restricted
to NEXT_PUBLIC_APP_URL when NODE_ENV=production; stays "*" in dev so
localhost uploads keep working.

src/trpc/routers/videos.ts

@@ -32,8 +32,11 @@ export const videosRouter = router({
 
       // Create Mux direct upload — client PUTs directly to the returned URL
       const upload = await mux.video.uploads.create({
-        // "*" allows uploads from any origin (dev + prod); restrict to APP_URL in production if needed
-        cors_origin: "*",
+        // "*" in dev so localhost uploads still work; locked to the real
+        // domain in production (this project shares one Clerk/DB between
+        // local dev and prod, but Mux's CORS origin still differs by env).
+        cors_origin:
+          process.env.NODE_ENV === "production" ? (process.env.NEXT_PUBLIC_APP_URL ?? "*") : "*",
         new_asset_settings: {
           playback_policy: ["public"],
           max_resolution_tier: "1080p",