fix: disable astro checkOrigin (breaks multipart uploads behind proxy); SameSite=Lax covers CSRF

astro.config.mjs

@@ -7,6 +7,9 @@ export default defineConfig({
   output: 'server',
   adapter: node({ mode: 'standalone' }),
   integrations: [react()],
+  // CSRF: eigener Schutz über SameSite=Lax-Session-Cookie. Astros checkOrigin
+  // bricht multipart-Uploads hinter dem Reverse-Proxy (http↔https-Mismatch).
+  security: { checkOrigin: false },
   server: { host: true, port: Number(process.env.PORT) || 4321 },
   vite: {
     ssr: {