fix: relax login origin check to hostname level, log origin/host on reject

Real browsers behind proxies/alternate listeners can produce port or case
mismatches between the Origin header and the incoming Host header, which
the strict host-level comparison rejected ("非法请求来源"). Compare
hostnames instead (still blocking foreign sites) and record the raw origin
and host values in the audit entry for future diagnostics.

Tests: cross-origin POST rejection, same-hostname different-port tolerance,
audit origin/host field assertions.

index.js

@@ -373,6 +373,16 @@ function sanitizeNext(next) {
   return next
 }
 
+function sameHost(originHeader, hostHeader) {
+  try {
+    const originHost = new URL(originHeader).hostname.toLowerCase()
+    const hostHost = new URL(`http://${hostHeader}`).hostname.toLowerCase()
+    return originHost === hostHost
+  } catch {
+    return false
+  }
+}
+
 function readBody(req, maxBytes) {
   return new Promise((resolveBody) => {
     let size = 0
@@ -439,20 +449,24 @@ export function installGuard(server, guard, { audit, loginPath, logoutPath }) {
       return
     }
     // Cross-origin form posts are rejected: the login form must come from this host.
+    // Hostname-level comparison tolerates port/case differences that proxies
+    // or alternate listeners introduce, while still blocking foreign sites.
     const origin = req.headers.origin
     const host = req.headers.host
-    if (typeof origin === 'string' && typeof host === 'string') {
-      try {
-        if (new URL(origin).host !== host) {
-          audit.write({ event: 'login-fail', username: '', ip: clientIp(req), ua: req.headers['user-agent'] ?? '', reason: 'cross-origin' })
-          serveLogin(req, res, '非法请求来源', 403, queryNext)
-          return
-        }
-      } catch {
-        audit.write({ event: 'login-fail', username: '', ip: clientIp(req), ua: req.headers['user-agent'] ?? '', reason: 'cross-origin' })
-        serveLogin(req, res, '非法请求来源', 403, queryNext)
-        return
-      }
+    const ip = clientIp(req)
+    const ua = req.headers['user-agent'] ?? ''
+    if (typeof origin === 'string' && typeof host === 'string' && !sameHost(origin, host)) {
+      audit.write({
+        event: 'login-fail',
+        username: '',
+        ip,
+        ua,
+        reason: 'cross-origin',
+        origin: String(origin).slice(0, 200),
+        host: String(host).slice(0, 200),
+      })
+      serveLogin(req, res, '非法请求来源', 403, queryNext)
+      return
     }
     const body = await readBody(req, 8192)
     if (body === null) {
@@ -464,8 +478,6 @@ export function installGuard(server, guard, { audit, loginPath, logoutPath }) {
     const username = fields.get('username') ?? ''
     const password = fields.get('password') ?? ''
     const next = sanitizeNext(fields.get('next') ?? queryNext)
-    const ip = clientIp(req)
-    const ua = req.headers['user-agent'] ?? ''
     if (!username || !password) {
       audit.write({ event: 'login-fail', username, ip, ua, reason: 'missing-fields' })
       serveLogin(req, res, '请输入用户名和密码', 403, next)