fix(middleware): Origin 同源校验增加 scheme 比对

http/https 不再视为同源；可信反代后采信 X-Forwarded-Proto（round2 P2-11），补测试。

internal/middleware/origin_test.go

@@ -0,0 +1,50 @@
+package middleware
+
+import (
+	"crypto/tls"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+// TestSameOriginSchemeSameOrigin 校验 host 与 scheme 双比对（评审 round2 P2-11）：
+// 仅 host 相同、scheme 不同的 Origin（如对 https 站点的 http://host）必须拒绝。
+func TestSameOriginScheme(t *testing.T) {
+	mk := func(origin string, tlsConn bool, behindProxy bool, xfp string) *http.Request {
+		r := httptest.NewRequest(http.MethodPost, "http://example.com/api/auth/login", nil)
+		if origin != "" {
+			r.Header.Set("Origin", origin)
+		}
+		if tlsConn {
+			r.TLS = &tls.ConnectionState{}
+		}
+		if behindProxy {
+			r = WithBehindProxy(r, true)
+		}
+		if xfp != "" {
+			r.Header.Set("X-Forwarded-Proto", xfp)
+		}
+		return r
+	}
+
+	cases := []struct {
+		name string
+		r    *http.Request
+		want bool
+	}{
+		{"http 直连 + http Origin", mk("http://example.com", false, false, ""), true},
+		{"http 直连 + https Origin（scheme 不匹配）", mk("https://example.com", false, false, ""), false},
+		{"https 直连 + https Origin", mk("https://example.com", true, false, ""), true},
+		{"https 直连 + http Origin（scheme 不匹配）", mk("http://example.com", true, false, ""), false},
+		{"反代 XFP=https + https Origin", mk("https://example.com", false, true, "https"), true},
+		{"反代 XFP=https + http Origin（scheme 不匹配）", mk("http://example.com", false, true, "https"), false},
+		{"反代未带 XFP 视为 http + http Origin", mk("http://example.com", false, true, ""), true},
+		{"host 不同", mk("http://evil.com", false, false, ""), false},
+		{"缺 Origin/Referer", mk("", false, false, ""), false},
+	}
+	for _, tc := range cases {
+		if got := sameOrigin(tc.r); got != tc.want {
+			t.Errorf("%s: 期望 %v，实际 %v", tc.name, tc.want, got)
+		}
+	}
+}