Single-origin URL rewriting; configurable SQLite path; default InjectAuthValues=false

- ClientMod: add SingleOriginBaseUrl config + URI rewrite path so the
  client can talk to one https://<apex>/__dn/<service>/... base
  instead of demanding wildcard subdomains. ServerHost rewrite still
  the fallback when SingleOriginBaseUrl is empty.
- ClientMod config: InjectAuthValues now defaults to false. The
  server's PhotonCustomAuthController already fail-opens
  (Photon:RequireCustomAuth=false), so anonymous bootstrap is the
  cleaner default and avoids Photon's CustomAuthFailed loop when a
  WAF returns 403 to Photon's probe.
- Server: SQLite path now reads Database:SqlitePath config
  (Database__SqlitePath env). Falls back to <bin>/data/dorknet.db
  so existing Docker / standalone deploys are unchanged. Lets the
  Windows launcher put the db under %APPDATA%\DorkNet.
- Server: DomainConfig + ConfigService updates for the single-origin
  apex.
- .gitignore: exclude local-releases.zip.

DorkNet.Server/Services/ConfigService.cs

@@ -23,7 +23,9 @@ public class ConfigService(IConfiguration config, DomainConfig domain)
         return new RecRoomConfig
         {
             MessageOfTheDay = config["Server:MOTD"] ?? "Welcome to the private server!",
-            CdnBaseUri = domain.SubUrl("cdn"),
+            CdnBaseUri = domain.SingleOriginEnabled
+                ? $"{domain.SingleOriginBaseUrl}/__dn/cdn"
+                : domain.SubUrl("cdn"),
             PhotonConfig = photon,
             ServiceUrls = BuildServiceUrlMap(domain),
             ConfigTable = new Dictionary<string, string>
@@ -110,6 +112,12 @@ public class ConfigService(IConfiguration config, DomainConfig domain)
         var map = new Dictionary<string, string>(ServiceSubdomains.Length);
         foreach (var (service, sub) in ServiceSubdomains)
         {
+            if (domain.SingleOriginEnabled)
+            {
+                var prefix = string.IsNullOrEmpty(sub) ? "www" : sub;
+                map[service] = $"{domain.SingleOriginBaseUrl}/__dn/{prefix}";
+                continue;
+            }
             var host = string.IsNullOrEmpty(sub) ? domain.Apex : domain.Sub(sub);
             map[service] = domain.Url(host);
         }

DorkNet.Server/Services/DomainConfig.cs

@@ -13,12 +13,17 @@ public sealed class DomainConfig
     public string Apex { get; }
     public string Scheme { get; }
     public string? Port { get; }
+    public string? SingleOriginBaseUrl { get; }
+    public bool SingleOriginEnabled => !string.IsNullOrWhiteSpace(SingleOriginBaseUrl);
 
-    public DomainConfig(string apex, string scheme = "https", string? port = null)
+    public DomainConfig(string apex, string scheme = "https", string? port = null, string? singleOriginBaseUrl = null)
     {
         Apex = apex;
         Scheme = string.IsNullOrWhiteSpace(scheme) ? "https" : scheme.TrimEnd(':', '/', '\\');
         Port = string.IsNullOrWhiteSpace(port) ? null : port.Trim().TrimStart(':');
+        SingleOriginBaseUrl = string.IsNullOrWhiteSpace(singleOriginBaseUrl)
+            ? null
+            : singleOriginBaseUrl.Trim().TrimEnd('/');
     }
 
     public string Sub(string prefix) => $"{prefix}.{Apex}";