fix(server): inert proxy responses, API-call header, image-only uploads; origin check by host

From the final review: proxied archived HTML could run on our origin and read a
remembered token; /api/upload accepted any Wayback URL and GIF-prefixed bytes; the
origin check broke behind a TLS proxy; one unreadable snapshot could fail a run.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/ARCHITECTURE.md

@@ -58,6 +58,8 @@ Put it behind a reverse proxy that terminates TLS and **appends** the client add
   no file is deleted before its 30 days.
 - Nothing is uploaded or submitted without an explicit user action; saves use `save_mode: "review"`.
 - `/api/fetch` only fetches allowlisted hosts; `/api/upload` only takes a source URL, never bytes.
+- Proxied bodies are inert (`application/octet-stream`, sandbox CSP, attachment), and `/api/*` fetch/upload need
+  the `x-mbseed: 1` header; `/api/upload` only rehosts from source image hosts or their Wayback copies.
 
 ## Known rough edges
 See the open questions in spec §7 and [`TODO.md`](TODO.md).