fix: relax login origin check to hostname level, log origin/host on reject

Real browsers behind proxies/alternate listeners can produce port or case
mismatches between the Origin header and the incoming Host header, which
the strict host-level comparison rejected ("非法请求来源"). Compare
hostnames instead (still blocking foreign sites) and record the raw origin
and host values in the audit entry for future diagnostics.

Tests: cross-origin POST rejection, same-hostname different-port tolerance,
audit origin/host field assertions.

test.mjs

@@ -85,6 +85,15 @@ r = await post('/panel-auth/login', 'username=admin&password=wrong&next=%2Fsome%
 assert.equal(r.status, 403)
 assert.match(await r.text(), /用户名或密码错误/)
 
+// 5b. cross-origin POST → 403 + audit records origin/host
+r = await post('/panel-auth/login', 'username=admin&password=s3cret-pass&next=%2F', { Origin: 'https://evil.example.com' })
+assert.equal(r.status, 403)
+assert.match(await r.text(), /非法请求来源/)
+
+// 5c. same hostname with a different port → tolerated (tunnel/proxy case)
+r = await post('/panel-auth/login', 'username=admin&password=s3cret-pass&next=%2F', { Origin: 'http://127.0.0.1:9999' })
+assert.equal(r.status, 303)
+
 // 6. POST login with correct credentials → 303 + cookie + next
 r = await post('/panel-auth/login', 'username=admin&password=s3cret-pass&next=%2Fsome%2Fpage')
 assert.equal(r.status, 303)
@@ -126,6 +135,9 @@ const ok = auditLines.find((e) => e.event === 'login-ok')
 assert.equal(ok.username, 'admin')
 const fail = auditLines.find((e) => e.event === 'login-fail' && e.reason === 'bad-credentials')
 assert.equal(fail.username, 'admin')
+const co = auditLines.find((e) => e.event === 'login-fail' && e.reason === 'cross-origin')
+assert.equal(co.origin, 'https://evil.example.com')
+assert.match(co.host, /^127\.0\.0\.1:/)
 assert.equal(auditLines.every((e) => typeof e.ip === 'string' && typeof e.ts === 'string'), true)
 
 // 12. XSS: hostile `next` value is escaped in the page