fix(server): inert proxy responses, API-call header, image-only uploads; origin check by host

From the final review: proxied archived HTML could run on our origin and read a
remembered token; /api/upload accepted any Wayback URL and GIF-prefixed bytes; the
origin check broke behind a TLS proxy; one unreadable snapshot could fail a run.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/html.test.ts

@@ -23,3 +23,7 @@ test("finds tags and meta content by property or name", () => {
 test("textOf strips tags and collapses whitespace", () => {
   expect(textOf("<span>Tower</span>\n  of &amp; God ")).toBe("Tower of & God");
 });
+
+test("an out-of-range numeric entity is left as written instead of throwing", () => {
+  expect(decodeEntities("a &#99999999; b &#x110000; c")).toBe("a &#99999999; b &#x110000; c");
+});