fix(server): inert proxy responses, API-call header, image-only uploads; origin check by host

From the final review: proxied archived HTML could run on our origin and read a
remembered token; /api/upload accepted any Wayback URL and GIF-prefixed bytes; the
origin check broke behind a TLS proxy; one unreadable snapshot could fail a run.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/core/hosting/host.ts

@@ -1,4 +1,4 @@
-import type { Transport } from "../transport";
+import { API_CALL_HEADER, type Transport } from "../transport";
 
 export type HostId = "server" | "litterbox" | "catbox" | "direct";
 export type LitterboxTime = "1h" | "12h" | "24h" | "72h";
@@ -55,7 +55,7 @@ export async function viaServer(
   if (ctx.serverBase === null) throw new HostError("No mangabaka-seeder server is configured.");
   const res = await ctx.transport.fetch(`${ctx.serverBase}/api/upload`, {
     method: "POST",
-    headers: { "content-type": "application/json" },
+    headers: { "content-type": "application/json", [API_CALL_HEADER]: "1" },
     body: JSON.stringify({ url: image.sourceUrl, ...body }),
     timeoutMs: UPLOAD_TIMEOUT_MS,
   });