fix: tolerate loopback Host behind reverse proxy, document Caddy setup

DSH pins privileged /api methods (settings.*, credentials.*, agentPreset.*,
host.pickDirectory, ...) to loopback hosts by design. When a reverse proxy
fronts the panel with the public Host header, those methods return 403.

The supported deployment shape is forwarding Host as loopback upstream
(header_up Host 127.0.0.1 in Caddy). This change:
- skips the login origin check when the incoming Host is loopback (proxy
  context), while still rejecting real cross-site posts on public hosts;
- documents the reverse-proxy requirement in the README;
- extends tests with raw-request coverage for non-loopback cross-site
  rejection, port tolerance, and loopback-Host skip.

README.md

@@ -63,6 +63,26 @@
 > 300ms 失败延迟 + scrypt 慢哈希兜底。公网反代场景建议再配合 Caddy
 > 层的 IP 白名单/云防火墙（如 Cloudflare）使用。
 
+## 反向代理部署（重要）
+
+DSH 上游将 `settings.*`、`credentials.*`、`agentPreset.*`、`host.pickDirectory`
+等**特权 /api 方法锁定为仅回环（loopback）Host 可访问**（浏览器信任围栏的
+设计：面板预期经 SSH 隧道访问）。用反向代理（如 Caddy）前置面板时，需把
+Host 以回环形式转发给面板，否则这些方法返回 `403 forbidden`：
+
+```
+dsh.example.com {
+	reverse_proxy 127.0.0.1:3080 {
+		header_up Host 127.0.0.1
+	}
+}
+```
+
+- 认证不受影响：所有请求仍先过 panel-auth（密码/Cookie + 防爆破），
+  且 panel-auth 的 Cookie 是浏览器端存储，与 Host 头无关。
+- panel-auth 的来源校验在 Host 为回环时自动跳过（代理场景）；对外域名下的
+  真实跨站提交仍会被拒绝（`非法请求来源`）。
+
 ## 修改密码
 
 ```bash