fix(timestamp): fall back to the default CORS proxy on official domains

The timestamp tool requires a CORS proxy: none of the built-in TSA endpoints send Access-Control-Allow-Origin, so the browser blocks the RFC 3161 POST. The runtime only used a proxy when VITE_CORS_PROXY_URL was set, and the official build never set it, leaving timestamping broken on www.bentopdf.com and on the published Docker images.

Fall back to the project-operated proxy on the official domains only (bentopdf.com, www.bentopdf.com), matching the origin already allowed in the generated CSP. Self-hosted instances keep requiring their own proxy.

src/js/logic/digital-sign-pdf.ts

@@ -103,8 +103,34 @@ export function parseCombinedPem(
  * and set VITE_CORS_PROXY_URL environment variable.
  *
  * If not set, certificates requiring external chain fetching will fail.
+ *
+ * On the official BentoPDF domains we fall back to the project-operated proxy.
+ * The generated CSP already allows that origin by default (see
+ * scripts/generate-security-headers.mjs), but the runtime never used it, which
+ * left the timestamp tool broken on the official HTTPS site. The fallback is
+ * deliberately scoped to the official domains so self-hosted instances keep
+ * requiring their own proxy.
  */
-const CORS_PROXY_URL = import.meta.env.VITE_CORS_PROXY_URL || '';
+const DEFAULT_CORS_PROXY_URL =
+  'https://bentopdf-cors-proxy.bentopdf.workers.dev';
+
+const OFFICIAL_HOSTNAMES = new Set(['bentopdf.com', 'www.bentopdf.com']);
+
+function resolveCorsProxyUrl(): string {
+  const configured = import.meta.env.VITE_CORS_PROXY_URL || '';
+  if (configured) {
+    return configured;
+  }
+
+  if (typeof window === 'undefined') {
+    return '';
+  }
+
+  const hostname = window.location?.hostname?.toLowerCase() ?? '';
+  return OFFICIAL_HOSTNAMES.has(hostname) ? DEFAULT_CORS_PROXY_URL : '';
+}
+
+const CORS_PROXY_URL = resolveCorsProxyUrl();
 
 /**
  * Shared secret for signing proxy requests (HMAC-SHA256).