Fix white screen: rewrite internal-host Location headers in proxy

Root cause: Postiz's Next.js middleware builds redirect URLs using the
incoming Host header, which health-server sets to 127.0.0.1:5000 (nginx's
address). The middleware produces absolute URLs like:

307 Location: http://127.0.0.1:5000/auth/login

HF Spaces' reverse proxy blocks redirects to internal IPs and silently
returns 200 with empty body — the white screen users see.

Additionally, Postiz's middleware redirects to /auth/* without the basePath
prefix (/app), so even relative redirects would land on a 404.

Fix: add rewriteLocation() that normalises every Location header from the
Postiz nginx upstream before forwarding to the browser:
- Absolute URL to internal host (127.0.0.1, localhost) → extract path
- Path missing /app basePath prefix → prepend /app
- External URLs (twitter.com, etc.) → unchanged

Result: 307 http://127.0.0.1:5000/auth/login → 307 /app/auth/login
Browser follows the redirect, health-server routes /app/auth/login to
nginx, Next.js serves the login page.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

health-server.js

@@ -637,6 +637,39 @@ function buildProxyHeaders(headers) {
   };
 }
 
+function rewriteLocation(loc) {
+  // Postiz's Next.js middleware redirects without the basePath prefix (/app)
+  // and may use an internal hostname (127.0.0.1:NGINX_PORT) that HF Spaces'
+  // reverse proxy blocks (returning 200 empty body instead of the redirect).
+  //
+  // Normalise every Location header from the Postiz nginx proxy:
+  //   1. If it's an absolute URL to an internal host → extract the path.
+  //   2. If the resulting path doesn't start with /app → prepend /app.
+  //
+  // Examples:
+  //   http://127.0.0.1:5000/auth/login  → /app/auth/login
+  //   http://localhost:4200/auth         → /app/auth
+  //   /auth/login                        → /app/auth/login
+  //   /app/auth/login                    → /app/auth/login  (unchanged)
+  //   https://twitter.com/oauth/...      → unchanged (external host)
+  if (!loc) return loc;
+  let path = null;
+  if (loc.startsWith("/")) {
+    path = loc;
+  } else {
+    try {
+      const u = new URL(loc);
+      if (/^(127\.0\.0\.1|localhost)(:\d+)?$/.test(u.host)) {
+        path = u.pathname + u.search + u.hash;
+      }
+    } catch {}
+  }
+  if (path !== null && !path.startsWith("/app/") && path !== "/app") {
+    return "/app" + path;
+  }
+  return loc;
+}
+
 function proxyHttp(req, res, overridePath) {
   const targetPath = overridePath !== undefined ? overridePath : req.url;
   let upstreamStarted = false;
@@ -645,7 +678,12 @@ function proxyHttp(req, res, overridePath) {
       path: targetPath, headers: buildProxyHeaders(req.headers) },
     (proxyRes) => {
       upstreamStarted = true;
-      res.writeHead(proxyRes.statusCode || 502, proxyRes.headers);
+      // Rewrite Location headers: add /app basePath if missing, convert
+      // internal-host absolute URLs to relative paths.
+      const outHeaders = Object.assign({}, proxyRes.headers);
+      const fixedLoc = rewriteLocation(outHeaders["location"]);
+      if (fixedLoc !== outHeaders["location"]) outHeaders["location"] = fixedLoc;
+      res.writeHead(proxyRes.statusCode || 502, outHeaders);
       proxyRes.pipe(res);
     },
   );