gateway: honour LITELLM_CORS_ORIGINS from app env; expose cost headers (#38, #39)

start.sh hardcoded and exported LITELLM_CORS_ORIGINS, so the Cloudron app env that is meant to control it was silently overridden — the change I made earlier tonight looked applied and was inert. It now defaults only when unset, so the app env wins, and the co-op decision to allow all origins (co-op/support#38) actually takes effect. Comment rewritten for the current version and the reasoning. Also adds patch_expose_cost_headers.py (wired into the Dockerfile) so x-litellm-response-cost* can be read by cross-origin clients (co-op/support#39); upstream closed the request as stale, so it is handled at the app layer like the other patches.

start.sh

@@ -89,13 +89,19 @@ export NO_OPENAPI="True"
 # Proxy settings for Cloudron's reverse proxy
 export LITELLM_PROXY_BASE_URL="https://${CLOUDRON_APP_DOMAIN}"
 
-# CORS: LiteLLM v1.84.0 reads LITELLM_CORS_ORIGINS natively (upstream added
-# the env var in place of the old hardcoded `origins = ["*"]`). Lock browser
-# access to the co-op's own chat origin. The gateway is called
-# server-to-server (chat → portal → gateway) and by member API keys
-# (curl/SDKs, not browsers), so no wildcard is needed. A `*` here would let
-# any website's JS hit the gateway.
-export LITELLM_CORS_ORIGINS="https://chat.inference.coop"
+# CORS: LiteLLM reads LITELLM_CORS_ORIGINS natively (upstream replaced the
+# hardcoded `origins = ["*"]` with this env var in v1.84.0). The value is
+# deliberately OVERRIDABLE — a Cloudron app env now wins, where before this
+# export silently overrode it and made the app env look effective when it was not.
+#
+# The co-op decided to allow all origins (co-op/support#38, agreed on Loomio and
+# by a member): CORS is not an auth boundary here. Every request carries a
+# per-member bearer key, which the browser never attaches implicitly, so an origin
+# list buys nothing against a party that already holds a key — and a leaked key is
+# curl-able regardless. What actually constrains abuse is the per-key budget,
+# model scoping and revocation. The fallback keeps the old chat-only lock if the
+# env var is ever unset.
+export LITELLM_CORS_ORIGINS="${LITELLM_CORS_ORIGINS:-https://chat.inference.coop}"
 
 echo "PostgreSQL: ${CLOUDRON_POSTGRESQL_HOST}:${CLOUDRON_POSTGRESQL_PORT}"
 echo "Redis: ${CLOUDRON_REDIS_HOST}:${CLOUDRON_REDIS_PORT}"