refactor(server): share one proxy-header check across the local gates

localRequestGate.mjs owns the reverse-proxy header list and hasProxySignals;
Provider Settings, the cross-site gate and /mcp all use it instead of two
copies of the same nine names. The changelog credits the cross-site gate.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

src/keySetupCore.mjs

@@ -1,7 +1,8 @@
 /**
  * Key setup ("POWER UP") — the pure core.
  *
- * One registry, three pure functions, zero dependencies. The dev server's
+ * One registry and pure functions; its only import is the proxy-header check
+ * shared with the other local gates (localRequestGate.mjs). The dev server's
  * /api/setup endpoints (vite.config.js) and the in-app panel (keySetup.js)
  * are both thin shells over this module, so what a key is called, what it
  * unlocks, and how a .env line is written each live in exactly one place.
@@ -11,6 +12,8 @@
  * behavior below unit-testable.
  */
 
+import { hasProxySignals } from './localRequestGate.mjs';
+
 /** Longest accepted key/token value. Real provider keys are all far shorter. */
 export const KEY_SETUP_VALUE_LIMIT = 512;
 
@@ -184,30 +187,6 @@ export function parseWindowsUserSid(stdout) {
     : null;
 }
 
-/** Headers that reverse proxies, tunnels and CDNs add to a request. */
-export const PROXY_SIGNAL_HEADERS = Object.freeze([
-  'forwarded',
-  'via',
-  'x-forwarded-for',
-  'x-forwarded-host',
-  'x-forwarded-port',
-  'x-forwarded-proto',
-  'x-real-ip',
-  'cf-connecting-ip',
-  'cf-ray',
-]);
-
-/**
- * Whether a request carries reverse-proxy or CDN forwarding headers, so it
- * did not originate on this machine whatever its socket says. `headers` is
- * keyed by lower-case header name.
- */
-export function hasProxySignals(headers = {}) {
-  return PROXY_SIGNAL_HEADERS.some(
-    (name) => String(headers[name] || '').trim() !== '',
-  );
-}
-
 /**
  * Whether the launcher has sharing on. Every sharing signal the launcher
  * recognizes (scripts/pinokio-preflight.mjs) counts, so the two sets cannot