Add canonical origin allowlist for fail-closed public envs

[SpaleRuby]

Fix

• Add canonical-origin allowlist validation for PUBLIC_BASE_URL, MCP_BASE_URL, WEBSITE_BASE_URL.
• Keep non-canonical legacy/misaligned origins fail-closed.
• Add regression tests for rejected legacy origins and canonical-only generated links.

Пофиксил это для вас. Если это сэкономило вам время, можете закинуть донат на этот криптокошелек: 69cT26eTDKnqq3wfmDAau7mVBrN8jVTnVbMaSU4DVfxB

[NSPG13]

The PR is in the manual-security-review lane because origin handling is a security boundary. What passed: it targets fail-closed public environment behavior. What blocks main: accepted origins must be explicit, testable, and consistent across API, MCP, docs, and deployment. Action: run cargo run -p cli -- docs-contract-check and cargo test -p api, then add tests for every allowed origin, stale origin, malformed origin, and forwarded-header case. Done when the allowlist source and deployment configuration agree. This overlaps #692 and #743, so please consolidate or explain the distinct scope. Thanks for helping the community grow, and sorry for the review friction.