Fix logout 403 CSRF verification failed (#18) (#19)

## Summary
- Closes #18
- Logout POST was failing CSRF Origin checks on HTTPS because `CSRF_TRUSTED_ORIGINS` was unset (Django 5)
- Derive trusted origins from `DJANGO_ALLOWED_HOSTS` (override via `DJANGO_CSRF_TRUSTED_ORIGINS`)
- Trust reverse-proxy TLS headers in prod/beta (`SECURE_PROXY_SSL_HEADER`, secure cookies)

## Test plan
- [x] `python manage.py test public.tests.CsrfTrustedOriginsTests public.tests.LogoutCsrfTests`
- [ ] Deploy, log in on aimloperations.com, click Log Out → redirect home, no 403
- [ ] Confirm login still works after deploy

Reviewed-on: #19

.env.example

@@ -4,6 +4,8 @@ DJANGO_ENV=dev
 DJANGO_DEBUG=true
 DJANGO_SECRET_KEY=change-me-for-local-development
 DJANGO_ALLOWED_HOSTS=localhost,127.0.0.1,0.0.0.0
+# Optional; when unset, http:// origins are derived for local hosts.
+# DJANGO_CSRF_TRUSTED_ORIGINS=http://localhost:8000,http://127.0.0.1:8000
 
 # Database (docker-compose sets DATABASE_URL for the web service)
 DATABASE_URL=postgres://company_site:company_site@db:5432/company_site