Package verified Dune checkpoints for TrueNAS and HTTPS proxying

Serve built Workers directly through pinned Miniflare with persistent D1-compatible storage and startup migrations. Build and verify Docker images in CI; publish main checkpoints to GHCR for manual TrueNAS updates on port 33046. Preserve explicit public-origin checks and LAN-compatible cryptographic operation IDs.

Validation: 5,153 offline tests, typecheck, lint and build; 49 HTTP integration cases; HTTPS-origin create/join/chat/seat protection, foreign-origin rejection, exact saved-seat restart and browser asset serving. Independent persistence/proxy review completed. Clean Docker CI and actual NAS installation follow this source checkpoint.

app/api/rooms/[code]/control/route.ts

@@ -1,3 +1,4 @@
+import { requestOrigin } from '@/lib/request-origin';
 import {
   authenticate,
   createSeatHandover,
@@ -14,12 +15,12 @@ import {
 import { RuleError } from '@/game/engine';
 import { validSeatAiDelegateRequest } from '@/lib/seat-ai-delegation';
 import { resumeRoom } from '@/db/room-continuation';
-import { waitUntil } from 'cloudflare:workers';
+import { env, waitUntil } from 'cloudflare:workers';
 const noStore = { 'Cache-Control': 'no-store' };
 export async function POST(req: Request) {
   try {
     const url = new URL(req.url);
-    if (req.headers.get('origin') && req.headers.get('origin') !== url.origin)
+    if (req.headers.get('origin') && req.headers.get('origin') !== requestOrigin(req, env.DUNE_PUBLIC_ORIGIN))
       throw new SeatControlError(
         'Invalid request origin.',
         'INVALID_ORIGIN',
@@ -158,7 +159,7 @@ export async function POST(req: Request) {
       {
         headers: {
           ...noStore,
-          'Set-Cookie': `dune_${code}=${result.token}; HttpOnly; SameSite=Strict; Path=/api/rooms/${code}; Max-Age=2592000${url.protocol === 'https:' ? '; Secure' : ''}`,
+          'Set-Cookie': `dune_${code}=${result.token}; HttpOnly; SameSite=Strict; Path=/api/rooms/${code}; Max-Age=2592000${requestOrigin(req, env.DUNE_PUBLIC_ORIGIN).startsWith('https:') ? '; Secure' : ''}`,
         },
       },
     );