feat(auth): enhance custom-domain same-origin handling and proxy trust validation

.env.example

@@ -15,7 +15,8 @@ NEXT_PUBLIC_WS_URL=ws://localhost:4000
 
 
 # /* --------------- Connection settings for PostgreSQL database -------------- */
-# Frontend server
+# Frontend server. Optional for same-origin browser access; recommended as the
+# canonical callback/fallback origin in production. Use https and no path.
 FRONTEND_URL=http://localhost:3000
 
 # Optional canonical/backend URL if ever needed
@@ -35,6 +36,9 @@ SESSION_ABSOLUTE_TIMEOUT_HOURS=168
 
 
 # /* -------------------------- Reverse proxy / rate limiting ------------------------- */
+# Set true only when Doktainer is behind a trusted reverse proxy that overwrites
+# X-Forwarded-Host and X-Forwarded-Proto. This enables the effective-origin
+# fallback for clients that do not send Fetch Metadata.
 TRUST_PROXY=false
 RATE_LIMIT_MAX=300
 RATE_LIMIT_TIME_WINDOW=1 minute