### fix: verbessere CORS-Handling im Caddy-Proxy

- **Caddyfile:** Separates Handling für OPTIONS-Requests mit spezifischen Headern eingeführt, `defer` entfernt.
- **UI:** Aktualisierung des Versionsmarkers auf `v2026-04-23.23 - CADDY CORS OPTIONS FIX`.
- **Docs:** Ergänzung der Analyse und Lösung für Version 23.

config/docker/caddy/web-app/Caddyfile

@@ -19,18 +19,26 @@
 
 	# Reverse Proxy: Plan-B leitet nur /api/mail an den Mail-Service weiter
 	handle /api/mail/* {
+		@options method OPTIONS
+		handle @options {
+			header {
+				Access-Control-Allow-Origin "https://app.mo-code.at"
+				Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+				Access-Control-Allow-Headers "Content-Type, Authorization, *"
+				Access-Control-Allow-Credentials "true"
+				Access-Control-Max-Age "3600"
+			}
+			respond 204
+		}
+
 		header {
 			Access-Control-Allow-Origin "https://app.mo-code.at"
 			Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
-			Access-Control-Allow-Headers "*"
+			Access-Control-Allow-Headers "Content-Type, Authorization, *"
 			Access-Control-Allow-Credentials "true"
-			Access-Control-Max-Age "3600"
 			defer
 		}
 
-		@options method OPTIONS
-		respond @options 204
-
 		reverse_proxy mail-service:8085
 	}