### fix: verbessere CORS-Handling im Caddy-Proxy

- **Caddyfile:** `Access-Control-Allow-Headers` auf `*` gelockert, Versionsmarkers angepasst.
- **UI:** Aktualisierung des Versionsmarkers auf `v2026-04-23.25 - CADDY CATCH-ALL CORS`.
- **Docs:** Ergänzung der Analyse und Lösung für Version 25.

config/docker/caddy/web-app/Caddyfile

@@ -17,17 +17,18 @@
 
 	encode gzip zstd
 
-	# Reverse Proxy: Plan-B leitet nur /api/mail an den Mail-Service weiter
+	# CORS-Handshaking direkt im Proxy
+	# Wir erlauben ALLES für die Domain mo-code.at im Plan-B Modus
 	handle /api/mail/* {
 		@options method OPTIONS
 		handle @options {
 			header {
 				Access-Control-Allow-Origin "https://app.mo-code.at"
 				Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
-				Access-Control-Allow-Headers "Content-Type, Authorization, X-Requested-With"
+				Access-Control-Allow-Headers "*"
 				Access-Control-Allow-Credentials "true"
 				Access-Control-Max-Age "3600"
-				X-Caddy-CORS "preflight"
+				X-Caddy-CORS "preflight-v25"
 			}
 			respond "" 204
 		}
@@ -35,9 +36,9 @@
 		header {
 			Access-Control-Allow-Origin "https://app.mo-code.at"
 			Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
-			Access-Control-Allow-Headers "Content-Type, Authorization, X-Requested-With"
+			Access-Control-Allow-Headers "*"
 			Access-Control-Allow-Credentials "true"
-			X-Caddy-CORS "forward"
+			X-Caddy-CORS "forward-v25"
 			defer
 		}