fix: multi-domain CSRF allowlist, trustProxy for nginx-ingress TLS termination

- hooks.server.ts: replace empty stub with multi-origin CSRF guard
  - Always allows humorunits.com and dickloads.com (+ www variants)
  - ALLOWED_ORIGINS env var for additional origins (staging, preview)
  - Dev: localhost:3000/4173/5173 auto-allowed when NODE_ENV != production
    or ALLOWED_ORIGINS is unset — no config needed for local dev
- svelte.config.js: disable built-in single-origin CSRF check (we own it now)
  trustProxy: true so X-Forwarded-Proto/IP are correct behind nginx-ingress
- login route: derive secure-cookie flag from X-Forwarded-Proto header so
  session cookies are marked Secure even when Node sees plain HTTP from ingress
- deployment.yaml: add NODE_ENV=production and explicit ALLOWED_ORIGINS

svelte.config.js

@@ -3,7 +3,16 @@ import adapter from '@sveltejs/adapter-node';
 /** @type {import('@sveltejs/kit').Config} */
 const config = {
 	kit: {
-		adapter: adapter(),
+		adapter: adapter({
+			// Trust X-Forwarded-Proto / X-Forwarded-For from the nginx-ingress.
+			// Required so that `url.protocol` and client IP are correct behind the proxy.
+			trustProxy: true,
+		}),
+		// Disable SvelteKit's built-in single-origin CSRF check — we handle it
+		// ourselves in hooks.server.ts with a multi-origin allowlist.
+		csrf: {
+			checkOrigin: false,
+		},
 	},
 	vitePlugin: {
 		dynamicCompileOptions: ({ filename }) =>