fix(stream/goals): prevent unbounded SSE polling load and preserve recurring goal history

.env.example

@@ -22,6 +22,14 @@ NEXTAUTH_URL=http://localhost:3000
 # Must not have a trailing slash.
 # NEXT_PUBLIC_APP_URL=https://devtrack-delta.vercel.app
 
+# -------------------------------------------------------
+# CSRF protection — allowed origins for state-changing API requests
+# (optional — NEXTAUTH_URL is always included automatically)
+# Comma-separated list of additional origins permitted to make authenticated
+# mutations. Add preview / staging deployments here.
+# Example: ALLOWED_ORIGINS=https://staging.devtrack.app,https://preview.devtrack.app
+# ALLOWED_ORIGINS=
+
 # Generate with: openssl rand -base64 32
 NEXTAUTH_SECRET=your_nextauth_secret