fix(domain): trust current proxy host instead of cookie

[Alidantech]

Summary

• stop using the caller-supplied client_url cookie as domain authority
• derive x-client-url from the current request's proxy-owned forwarding headers
• normalize and validate the forwarded host before sending backend requests

Security impact

Prevents a stale or forged first-request cookie from selecting another tenant/domain.

Files

• src/client.ts

Validation

• branch diff reviewed
• no .github/** files changed
• no secrets or generated caches changed

Release note

Publish a new package version and refresh consuming lockfiles before production deployment.