Package verified Dune checkpoints for TrueNAS and HTTPS proxying

Serve built Workers directly through pinned Miniflare with persistent D1-compatible storage and startup migrations. Build and verify Docker images in CI; publish main checkpoints to GHCR for manual TrueNAS updates on port 33046. Preserve explicit public-origin checks and LAN-compatible cryptographic operation IDs.

Validation: 5,153 offline tests, typecheck, lint and build; 49 HTTP integration cases; HTTPS-origin create/join/chat/seat protection, foreign-origin rejection, exact saved-seat restart and browser asset serving. Independent persistence/proxy review completed. Clean Docker CI and actual NAS installation follow this source checkpoint.

tests/bot-pacing.test.ts

@@ -1,3 +1,4 @@
+import { requestOrigin } from '../lib/request-origin';
 import test from 'node:test';
 import assert from 'node:assert/strict';
 import { webcrypto } from 'node:crypto';
@@ -81,6 +82,7 @@ function unitStore(runBots = bots.runBots) {
       require: (name: string) => {
         if (name === 'cloudflare:workers') return { env: { DB: database } };
         if (name === '@/game/engine') return engine;
+        if (name === '@/lib/request-origin') return { requestOrigin };
         if (name === '@/game/bots') return { ...bots, runBots };
         if (name === '@/lib/seat-ai-delegation') return seatAiDelegation;
         throw new Error('Unexpected module ' + name);
@@ -359,8 +361,10 @@ void test('authenticated GET schedules the persisted queue after reconnect while
             };
           if (name === '@/db/room-continuation') return continuation;
           if (name === '@/game/engine') return engine;
+          if (name === '@/lib/request-origin') return { requestOrigin };
           if (name === 'cloudflare:workers')
             return {
+              env: {},
               waitUntil: (work: Promise<unknown>) => pending.push(work),
             };
           throw new Error('Unexpected route dependency ' + name);