fix: set DEER_FLOW_TRUSTED_ORIGINS for Next.js — fixes Application error

The pre-built frontend image (af6e48cc) uses an older gateway-config.ts
that has NO defaults in production mode. Both DEER_FLOW_INTERNAL_GATEWAY_BASE_URL
and DEER_FLOW_TRUSTED_ORIGINS must be set explicitly — otherwise zod
schema validation throws, getServerSideUser() returns {tag:"config_error"},
workspace/auth layouts throw new Error(), and Next.js shows
"Application error: a server-side exception has occurred" on every page.

We were setting INTERNAL_GATEWAY_BASE_URL but not TRUSTED_ORIGINS.
TRUSTED_ORIGINS set to localhost:3000 + localhost:7860 + SPACE_HOST.

With this fix the SSR no longer throws. /workspace redirects to /login
(unauthenticated) or /setup (first boot). /setup renders the admin
account creation form.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

start.sh

@@ -390,11 +390,21 @@ if [ "$ready" != "true" ]; then
 fi
 echo "Backend ready."
 
+# ── Build DEER_FLOW_TRUSTED_ORIGINS ───────────────────────────────
+# Required in production mode by the pre-built frontend image (af6e48cc):
+# gateway-config.ts has NO defaults in prod — both vars must be explicit
+# or zod schema fails → config_error → "Application error" on every page.
+TRUSTED_ORIGINS="http://localhost:3000,http://localhost:7860"
+if [ -n "${SPACE_HOST:-}" ]; then
+  TRUSTED_ORIGINS="$TRUSTED_ORIGINS,https://$SPACE_HOST"
+fi
+
 # ── Start frontend (Next.js) ──────────────────────────────────────
 echo "Starting Next.js frontend on port $FRONTEND_PORT..."
 (
   cd "$APP_DIR/frontend" && \
   DEER_FLOW_INTERNAL_GATEWAY_BASE_URL="http://127.0.0.1:$BACKEND_PORT" \
+  DEER_FLOW_TRUSTED_ORIGINS="$TRUSTED_ORIGINS" \
   PORT="$FRONTEND_PORT" \
   NODE_OPTIONS="--require $APP_DIR/cloudflare-proxy.js" \
   node_modules/.bin/next start -p "$FRONTEND_PORT" \