patch CSRF and CI

backend/core/settings/production.py

@@ -23,6 +23,16 @@ CSRF_COOKIE_SECURE = True
 # Produkcijski CORS (samo domena na kojoj vrti Astro)
 CORS_ALLOWED_ORIGINS = os.environ.get('CORS_ALLOWED_ORIGINS', '').split(',')
 
+# csrf trusted origins za produkciju (env + poznate domene)
+CSRF_TRUSTED_ORIGINS = [
+    origin.strip()
+    for origin in os.environ.get('CSRF_TRUSTED_ORIGINS', '').split(',')
+    if origin.strip()
+] + [
+    'https://api-004.captain.mitteworkspace.cloud',
+    'https://serviseri-004.captain.mitteworkspace.cloud',
+]
+
 # Statika i Mediji
 STATIC_ROOT = '/app/staticfiles'
 MEDIA_ROOT = '/app/media'