STAGE 45 — API CORS

Adds browser/PWA cross-origin support for /api/v1/ using Apache headers.
Bearer-token API; credentials are not enabled.
No SQL/schema changes.

Test:
https://ieduportal.com/school-management-system/public/upgrade/stage45.php
