refactor(server): share one proxy-header check across the local gates

localRequestGate.mjs owns the reverse-proxy header list and hasProxySignals;
Provider Settings, the cross-site gate and /mcp all use it instead of two
copies of the same nine names. The changelog credits the cross-site gate.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

src/keySetupCore.mjs

@@ -1,7 +1,8 @@
 /**
  * Key setup ("POWER UP") — the pure core.
  *
- * One registry, three pure functions, zero dependencies. The dev server's
+ * One registry and pure functions; its only import is the proxy-header check
+ * shared with the other local gates (localRequestGate.mjs). The dev server's
  * /api/setup endpoints (vite.config.js) and the in-app panel (keySetup.js)
  * are both thin shells over this module, so what a key is called, what it
  * unlocks, and how a .env line is written each live in exactly one place.
@@ -11,6 +12,8 @@
  * behavior below unit-testable.
  */
 
+import { hasProxySignals } from './localRequestGate.mjs';
+
 /** Longest accepted key/token value. Real provider keys are all far shorter. */
 export const KEY_SETUP_VALUE_LIMIT = 512;
 
@@ -184,30 +187,6 @@ export function parseWindowsUserSid(stdout) {
     : null;
 }
 
-/** Headers that reverse proxies, tunnels and CDNs add to a request. */
-export const PROXY_SIGNAL_HEADERS = Object.freeze([
-  'forwarded',
-  'via',
-  'x-forwarded-for',
-  'x-forwarded-host',
-  'x-forwarded-port',
-  'x-forwarded-proto',
-  'x-real-ip',
-  'cf-connecting-ip',
-  'cf-ray',
-]);
-
-/**
- * Whether a request carries reverse-proxy or CDN forwarding headers, so it
- * did not originate on this machine whatever its socket says. `headers` is
- * keyed by lower-case header name.
- */
-export function hasProxySignals(headers = {}) {
-  return PROXY_SIGNAL_HEADERS.some(
-    (name) => String(headers[name] || '').trim() !== '',
-  );
-}
-
 /**
  * Whether the launcher has sharing on. Every sharing signal the launcher
  * recognizes (scripts/pinokio-preflight.mjs) counts, so the two sets cannot

src/localRequestGate.mjs

@@ -21,10 +21,9 @@
  */
 /**
  * Reverse-proxy / CDN forwarding headers. Their presence means the request did
- * not originate on this machine, whatever its socket says. Kept as this
- * module's own list (keySetupCore.mjs carries the same nine names for the
- * credential panel) so the gate has no imports and can sit in any package
- * boundary.
+ * not originate on this machine, whatever its socket says. This module owns
+ * the list for every local gate (the credential panel and /mcp import
+ * `hasProxySignals`), and has no imports so it can sit in any package boundary.
  */
 export const PROXY_SIGNALS = Object.freeze([
   'forwarded',
@@ -38,6 +37,16 @@ export const PROXY_SIGNALS = Object.freeze([
   'cf-ray',
 ]);
 
+/**
+ * Whether a request carries reverse-proxy or CDN forwarding headers. `headers`
+ * is keyed by lower-case header name.
+ */
+export function hasProxySignals(headers = {}) {
+  return PROXY_SIGNALS.some(
+    (name) => String(headers[name] || '').trim() !== '',
+  );
+}
+
 /**
  * Compute a request's own authority (an origin string) from its protocol and
  * Host header. Unlike the credential-panel gate's localhost-restricted
@@ -90,9 +99,7 @@ export function admitSameSiteRequest({
 } = {}) {
   // (1) A request carrying reverse-proxy / CDN forwarding headers did not
   // originate on this machine, whatever its socket says.
-  if (
-    PROXY_SIGNALS.some((name) => String(proxyHeaders[name] || '').trim() !== '')
-  ) {
+  if (hasProxySignals(proxyHeaders)) {
     return {
       ok: false,
       status: 403,