Changes trustedOrigins from a single-string wrap to a comma-split array
so both demo.groombook.dev and groombook.farh.net can coexist as trusted
Better-Auth origins via a single CORS_ORIGIN env value.
Updated UAT_PLAYBOOK.md §4.1 — added TC-API-1.27 and TC-API-1.28 for
multi-origin callbackURL coverage.
Co-Authored-By: Paperclip <noreply@paperclip.ing>