Add CSRF_TRUSTED_ORIGINS setting for self-hosted deployments

Django requires CSRF_TRUSTED_ORIGINS to be set for POST requests
(including login) when using HTTPS or non-standard ports. Without
this setting, login attempts fail with "CSRF verification failed".

The setting is now configurable via CSRF_TRUSTED_ORIGINS environment
variable, similar to CORS_ALLOWED_ORIGINS.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

config/settings/selfhosted.py

@@ -93,6 +93,13 @@ CORS_ALLOWED_ORIGINS = os.environ.get(
     'http://localhost:8000'
 ).split(',')
 
+# CSRF - configurable for self-hosted
+# Must include the exact URL (with protocol and port) you're accessing the site from
+CSRF_TRUSTED_ORIGINS = os.environ.get(
+    'CSRF_TRUSTED_ORIGINS',
+    'http://localhost:8000'
+).split(',')
+
 # Static files
 STATICFILES_STORAGE = 'whitenoise.storage.CompressedManifestStaticFilesStorage'