remove origin validation

ALLOW_ANY_ORIGIN, ALLOW_ANY_ORIGIN_MUSIC, and everything they gated. The flag
defaulted to ON, so none of it ran on a real install — what comes out is
documented defence in depth that was already switched off. The file said so
itself: "Both flags and their call sites come out once the tailnet is the
perimeter."

Origin was never authentication here in any case. An app's `officer://<hex>`
origin is chosen by the client, forgeable outside a browser, and extractable from
a shipped binary.

Gone: the two flags, isOriginAllowed, isOriginCheckDisabled, isMusicOriginExempt,
originValidationMiddleware, ORIGIN_RULES and the whole OFFICER_<APP>_ORIGIN
scheme, PUBLIC_URL's origin/host derivation, and origin-validation.test.ts, which
existed only to pin them. CORS now echoes whatever Origin it is given, which is
what every install already did.

What SURVIVES is the reason this needed care. origin-validation.ts held two
unrelated things, and the second was the global authorization gate — a valid
non-owner token reaches only what its role grants, deliberately NOT under the
flag because it is account-based rather than origin-based. Its own comment called
it "the airtight half". Deleting the file wholesale would have deleted
authorization.

So it moves to _middlewares/capability-gate.ts as capabilityGateMiddleware, with
the name matching what it does: nothing in it reads an Origin header any more.
hono.ts mounts it in the same position, ahead of every router.

origin-middleware.ts stays and is untouched — it extracts the Origin for six auth
handlers that log it, and for passkeys. Extraction, not validation.

Also updates every claim that rested on the old model: CLAUDE.md's security
section and repo map, docs/secret-store.md, docs/mobile-api-keys.md, and five
messages in machine-setup's Tailscale section which told the owner to set
ALLOW_ANY_ORIGIN=false when declining a tailnet. That advice is now impossible to
follow, and the honest version is different: with no tailnet the token is the
whole lock, so put a proxy in front and restrict who can reach it.

Not typechecked (empty node_modules, frozen installs). Every changed file parses;
the setup section was run and writes four variables now.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/servers/_middlewares/user-middleware.ts

@@ -1,7 +1,6 @@
 import type { MiddlewareHandler } from 'hono';
 import { resolveAuthToken } from '@@/auth-token';
 import * as errors from '@@/custom-errors';
-import { isOriginAllowed, isMusicOriginExempt } from './origin-validation';
 import { isLockdown, noteBlocked } from '../api/auth/panic';
 import { getUserById, isTokenBlacklisted } from 'officerdb';
 
@@ -24,16 +23,9 @@ export const userMiddleware: MiddlewareHandler = async function (ctx, next) {
   }
   if (!token) throw errors.UNAUTHORIZED();
 
-  // Validate origin for authenticated routes.
-  // TEMPORARY, opt-in: ALLOW_ANY_ORIGIN_MUSIC=true drops the Origin check for /api/music only, so a
-  // client that can't present the app's custom-scheme origin can still reach the music API. Auth is
-  // untouched — a valid token is still required, and the non-owner account backstop in
-  // originScopeMiddleware still applies. Delete this and the env var once the tailnet is the perimeter.
-  const origin = ctx.get('origin') as string | undefined;
-  const host = ctx.req.header('host');
-  if (!isMusicOriginExempt(ctx.req.path) && !isOriginAllowed(origin, host)) {
-    throw errors.FORBIDDEN('Invalid origin');
-  }
+  // There was an Origin check here until 2026-08-13. It is gone with the rest of origin validation —
+  // it had defaulted to off, so it ran on no real install. A valid token is required below, and the
+  // capability gate in hono.ts confines a non-owner to what their role grants.
 
   try {
     // Both credentials resolve here — see auth-token.ts. Everything below applies to a session JWT only: