fix: multi-domain CSRF allowlist, trustProxy for nginx-ingress TLS termination

- hooks.server.ts: replace empty stub with multi-origin CSRF guard
  - Always allows humorunits.com and dickloads.com (+ www variants)
  - ALLOWED_ORIGINS env var for additional origins (staging, preview)
  - Dev: localhost:3000/4173/5173 auto-allowed when NODE_ENV != production
    or ALLOWED_ORIGINS is unset — no config needed for local dev
- svelte.config.js: disable built-in single-origin CSRF check (we own it now)
  trustProxy: true so X-Forwarded-Proto/IP are correct behind nginx-ingress
- login route: derive secure-cookie flag from X-Forwarded-Proto header so
  session cookies are marked Secure even when Node sees plain HTTP from ingress
- deployment.yaml: add NODE_ENV=production and explicit ALLOWED_ORIGINS

k8s/deployment.yaml

@@ -25,8 +25,12 @@ spec:
               value: "3000"
             - name: HOST
               value: "0.0.0.0"
+            - name: NODE_ENV
+              value: "production"
             - name: ORIGIN
-              value: "https://humorunits.com"  # replace with your domain
+              value: "https://humorunits.com"
+            - name: ALLOWED_ORIGINS
+              value: "https://humorunits.com,https://www.humorunits.com,https://dickloads.com,https://www.dickloads.com"
           envFrom:
             - secretRef:
                 name: humor-units-secrets  # SESSION_SECRET, PASSWORD_HASH