feat(httpapi): harden control plane and speed up prefix refresh

Очередь job получила lease и fencing, телеметрия и прогресс deploy сохраняются, ревизия пишет manifest входов. Обновление префиксов не переписывает неизменённый снимок, большие наборы идут через COPY, а устаревшая ревизия не попадает в deploy. Бандл ноды кэшируется, prune и постановка job больше не держат горячий путь.

Co-authored-by: Cursor <[email protected]>

internal/httpapi/speakers.go

@@ -6,7 +6,11 @@ import (
 	"encoding/hex"
 	"encoding/json"
 	"errors"
+	"net"
 	"net/http"
+	"net/netip"
+	"net/url"
+	"strconv"
 	"strings"
 	"time"
 
@@ -165,24 +169,65 @@ func publicControlPlaneURL(r *http.Request, override string) string {
 	if s := strings.TrimSpace(override); s != "" {
 		return strings.TrimRight(s, "/")
 	}
-	if origin := strings.TrimSpace(r.Header.Get("Origin")); strings.HasPrefix(origin, "http://") || strings.HasPrefix(origin, "https://") {
-		return strings.TrimRight(origin, "/")
-	}
-	proto := strings.TrimSpace(r.Header.Get("X-Forwarded-Proto"))
-	if proto == "" {
-		proto = "https"
-	}
-	host := strings.TrimSpace(r.Header.Get("X-Forwarded-Host"))
-	if i := strings.Index(host, ","); i >= 0 {
-		host = strings.TrimSpace(host[:i])
-	}
-	if host == "" {
-		host = strings.TrimSpace(r.Host)
-	}
-	if host == "" {
+	if r == nil {
 		return ""
 	}
-	return proto + "://" + host
+	if peer, ok := peerAddress(r); ok && isTrustedProxy(peer, trustedProxyPrefixes()) {
+		protos := r.Header.Values("X-Forwarded-Proto")
+		hosts := r.Header.Values("X-Forwarded-Host")
+		if len(protos) == 1 && len(hosts) == 1 {
+			proto := strings.TrimSpace(protos[0])
+			host := strings.TrimSpace(hosts[0])
+			if (proto == "http" || proto == "https") && validControlPlaneHost(host) {
+				return proto + "://" + host
+			}
+		}
+	}
+	if !validControlPlaneHost(r.Host) {
+		return ""
+	}
+	proto := "http"
+	if r.TLS != nil {
+		proto = "https"
+	}
+	return proto + "://" + r.Host
+}
+
+func validControlPlaneHost(host string) bool {
+	if host == "" || strings.TrimSpace(host) != host || strings.HasSuffix(host, ":") || strings.ContainsAny(host, " ,/@?#\\\t\r\n") {
+		return false
+	}
+	u, err := url.Parse("http://" + host)
+	if err != nil || u.Host != host || u.User != nil || u.Path != "" || u.RawQuery != "" || u.Fragment != "" {
+		return false
+	}
+	name := u.Hostname()
+	if name == "" {
+		return false
+	}
+	if strings.HasPrefix(host, "[") {
+		if _, err := netip.ParseAddr(name); err != nil {
+			return false
+		}
+	} else if net.ParseIP(name) == nil {
+		for _, label := range strings.Split(name, ".") {
+			if label == "" || label[0] == '-' || label[len(label)-1] == '-' {
+				return false
+			}
+			for _, c := range label {
+				if !(c >= 'a' && c <= 'z' || c >= 'A' && c <= 'Z' || c >= '0' && c <= '9' || c == '-') {
+					return false
+				}
+			}
+		}
+	}
+	if port := u.Port(); port != "" {
+		n, err := strconv.Atoi(port)
+		if err != nil || n < 1 || n > 65535 {
+			return false
+		}
+	}
+	return true
 }
 
 func (s *Server) attachReplicaInstall(resp map[string]any, sp *store.Speaker, nodeToken string, req speakerCreateRequest, r *http.Request) {