feat(19.3-06): purge route accepts proxied requests on siteCache.allowProxied (WR-03)

- runtimeConfig.siteCache.allowProxied (NUXT_SITE_CACHE_ALLOW_PROXIED, default
  false) lets the shared purge route accept a request that came through a
  TLS-terminating proxy; the bearer token is then the only gate
- shared lib, route and spec stay byte-identical across the three layers,
  with updated sha256 pins and two new sitePurge specs

- version 0.5.0

server/lib/siteCachePurge.ts

@@ -27,6 +27,12 @@ export interface SitePurgeAuthInput {
   authorization?: string | null
   /** True when the request carried X-Forwarded-For, X-Real-IP or Forwarded. */
   proxied: boolean
+  /**
+   * runtimeConfig.siteCache.allowProxied: when true a proxied request is not
+   * refused, and the bearer token is the only gate. For a backend that reaches
+   * the site through a TLS-terminating proxy, which adds forwarding headers.
+   */
+  allowProxied?: boolean
 }
 
 function digest(value: string): Buffer {
@@ -36,13 +42,14 @@ function digest(value: string): Buffer {
 /**
  * Decides a purge request: `disabled` when no token of at least
  * MIN_SITE_PURGE_TOKEN_LENGTH characters is configured, `proxied` when the
- * request came through a reverse proxy (checked before the token), `ok` when
- * the Bearer value equals the token (compared in constant time over sha256
- * digests) and `unauthorized` otherwise.
+ * request came through a reverse proxy (checked before the token) unless
+ * allowProxied is true, `ok` when the Bearer value equals the token (compared
+ * in constant time over sha256 digests) and `unauthorized` otherwise. With
+ * allowProxied the token is the only gate, so it must stay long and secret.
  */
-export function authorizeSitePurge({ token, authorization, proxied }: SitePurgeAuthInput): SitePurgeVerdict {
+export function authorizeSitePurge({ token, authorization, proxied, allowProxied }: SitePurgeAuthInput): SitePurgeVerdict {
   if (typeof token !== 'string' || token.length < MIN_SITE_PURGE_TOKEN_LENGTH) return 'disabled'
-  if (proxied) return 'proxied'
+  if (proxied && allowProxied !== true) return 'proxied'
   const m = /^Bearer[ \t]+(\S+)[ \t]*$/i.exec(authorization ?? '')
   if (!m) return 'unauthorized'
   return timingSafeEqual(digest(m[1]), digest(token)) ? 'ok' : 'unauthorized'