Allow configuring the proxy's `Access-Control-Expose-Headers` — e.g. via a new `LITELLM_CORS_EXPOSE_HEADERS` env var (comma-separated), mirroring the existing `LITELLM_CORS_ORIGINS` — so browser-based clients calling the proxy cross-origin can read the useful `x-litellm-*` response headers (notably `x-litellm-response-cost` and `x-litellm-model-api-base`).

Today `expose_headers` is hardcoded:

> `app.add_middleware(CORSMiddleware, allow_origins=origins, allow_credentials=allow_cors_credentials, allow_methods=["*"], allow_headers=["*"], expose_headers=LITELLM_UI_ALLOW_HEADERS)`

`origins`/credentials are env-configurable (`LITELLM_CORS_ORIGINS`, `LITELLM_CORS_ALLOW_CREDENTIALS`), but `expose_headers` is fixed to the `LITELLM_UI_ALLOW_HEADERS` constant with no override. On v1.84.0 the actual exposed set is only:

> `access-control-expose-headers: x-litellm-semantic-filter, x-litellm-semantic-filter-tools, x-litellm-adaptive-router-model`

**Motivation / pitch**

A browser app that talks to the proxy directly (OpenAI-compatible client) can't read cost or backend info, even though the proxy already returns it on every completion:

> `x-litellm-response-cost: 6.5e-05` > `x-litellm-mode…