chore: 统一本地服务器与远程仓库源码

- 合并 main 与 master 历史并以服务器结构为基线
- 保留迁移、数据保留、AWS 账单与部署安全能力
- 建立 SDD 规格和 CI 验证闭环

backend/router/agent_static.go

@@ -29,6 +29,10 @@ func registerAgentDownloads(r *gin.Engine, log *zap.Logger) {
 
 	r.GET("/agent/arch", func(c *gin.Context) {
 		base := requestBaseURL(c)
+		if base == "" {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "request host is required"})
+			return
+		}
 		downloads := availableAgentDownloads(paths.binDir)
 		c.JSON(http.StatusOK, gin.H{
 			"version":   "1.0.0",
@@ -110,11 +114,17 @@ func requestBaseURL(c *gin.Context) string {
 		scheme = "https"
 	}
 	if proto := c.GetHeader("X-Forwarded-Proto"); proto != "" {
-		scheme = proto
+		// 多级代理可能传逗号列表，首项是客户端最初使用的协议。 // Logan.Li
+		scheme = strings.TrimSpace(strings.Split(proto, ",")[0])
 	}
 	host := c.Request.Host
+	if forwardedHost := c.GetHeader("X-Forwarded-Host"); forwardedHost != "" {
+		// 多级代理可能传逗号列表，首项是客户端最初访问的域名。 // Logan.Li
+		host = strings.TrimSpace(strings.Split(forwardedHost, ",")[0])
+	}
 	if host == "" {
-		host = "localhost:8080"
+		// HTTP/1.1 正常请求必须带 Host，缺失时不再伪造本机地址。 // Logan.Li
+		return ""
 	}
 	return fmt.Sprintf("%s://%s", scheme, host)
 }