Per-key origin allowlist (server-side anti-junk, stronger than the analytics norm)

[aharlap]

Enhancement from the embedded-key security discussion (2026-07-08):

Proof's snippet key is already stronger than the Plausible/Umami model (their ingest endpoints are unauthenticated — public site identifiers only; Umami's data-domains guard is client-side in the tracker and trivially bypassed). The next step that would make Proof's anti-junk story the strongest in the category while keeping one-tag embeds:

• keys gains an optional allowed_origins column (comma-separated origins, set at mint time via an optional field on both mint paths)
• keyAuth (or a follow-on middleware) rejects statements when the key has an allowlist and the request's Origin header is present-and-not-listed (absent Origin — curl/server-side senders — policy decision: reject when allowlist set, since the allowlist signals browser-only intent)
• Keys page mint form + docs updated; embed.md roadmap sentence resolved
• Tests: allowlisted key + matching origin passes; mismatched origin 403s; no-allowlist key unchanged

🤖 Generated with Claude Code