gateway: honour LITELLM_CORS_ORIGINS from app env; expose cost headers (#38, #39)

start.sh hardcoded and exported LITELLM_CORS_ORIGINS, so the Cloudron app env that is meant to control it was silently overridden — the change I made earlier tonight looked applied and was inert. It now defaults only when unset, so the app env wins, and the co-op decision to allow all origins (co-op/support#38) actually takes effect. Comment rewritten for the current version and the reasoning. Also adds patch_expose_cost_headers.py (wired into the Dockerfile) so x-litellm-response-cost* can be read by cross-origin clients (co-op/support#39); upstream closed the request as stale, so it is handled at the app layer like the other patches.

Dockerfile

@@ -62,6 +62,10 @@ RUN python3 /app/code/patch_audio_router_pricing.py
 COPY patch_strip_provider_headers.py /app/code/patch_strip_provider_headers.py
 RUN python3 /app/code/patch_strip_provider_headers.py
 
+# Expose the per-request cost headers to cross-origin browser clients (co-op/support#39).
+COPY patch_expose_cost_headers.py /app/code/patch_expose_cost_headers.py
+RUN python3 /app/code/patch_expose_cost_headers.py
+
 # Audio keep-alive: scheduled pings keep the Tinfoil TEE audio enclave
 # warm so voice mode skips the ~24s cold-start (see audio_keepalive.py header).
 COPY audio_keepalive.py /app/code/audio_keepalive.py