revert: remove unnecessary serverActions.allowedOrigins

The 403 "Forbidden" on production was caused by ModSecurity WAF
(OWASP CRS 3.3.7) blocking PATCH/POST requests at the nginx layer,
not by Next.js server actions CSRF. Nginx proxy_set_header Host $host
ensures Origin and Host always match, making allowedOrigins redundant.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

next.config.mjs

@@ -7,14 +7,6 @@ const nextConfig = {
     // Use fewer workers for builds on low-memory systems
     workerThreads: false,
     cpus: 1,
-    // Allow server actions from these origins (behind reverse proxy)
-    serverActions: {
-      allowedOrigins: [
-        'pl.porwoll.tech',
-        'pl.c2sgmbh.de',
-        'cms.c2sgmbh.de',
-      ],
-    },
   },
   // Webpack configuration for TypeScript/ESM compatibility
   webpack: (webpackConfig) => {