fix(server): k8s rollout readiness

- TRUSTED_HOSTS env: configurable trusted hostnames for proxy-domain access (default stays strict: localhost/loopback/private IP); k8s manifest sets tg.workstation.internal (L-8 follow-up)
- Media allowlist +10: mkv/mk3d/heic/tgs/flv/3gp/ogv/asf/wmv/djvu (live disk has .tgs x44, .mkv x2)
- Cache buster: app.js?v=4 -> ?v=5 so browsers pick up the new bundle
- +6 tests (64 passing); REVIEW.md updated with live-cluster rollout notes

webui_server.py

@@ -118,15 +118,25 @@ def parse_bool(value: Any, default: bool = False) -> bool:
 # ── L-8: trusted-host check ──────────────────────────────────────────────
 import ipaddress  # noqa: E402
 
+# Comma-separated extra trusted hostnames for browser state-mutating
+# requests when the panel is served through a proxy domain.
+# Example: TRUSTED_HOSTS="tg.workstation.internal,example.com"
+_TRUSTED_HOSTS_ENV = frozenset(
+    h.strip().lower().rstrip(".") for h in os.environ.get("TRUSTED_HOSTS", "").split(",") if h.strip()
+)
+
 
 def _is_trusted_host(host: str) -> bool:
     """Return True if *host* (the ``Host`` header value) is a loopback /
     private address that this local-only deployment should trust."""
     hostname = host.split("@")[-1].split(":")[0]  # strip auth / port
+    hostname = hostname.strip().lower().rstrip(".")
     if not hostname:
         return False
     if hostname in {"localhost", "127.0.0.1", "::1"}:
         return True
+    if hostname in _TRUSTED_HOSTS_ENV:
+        return True
     try:
         addr = ipaddress.ip_address(hostname)
         return addr.is_loopback or addr.is_private or addr.is_link_local
@@ -157,6 +167,9 @@ _MEDIA_FILE_EXTENSIONS = frozenset({
     # archives / other Telegram document types
     ".zip", ".rar", ".7z", ".apk", ".epub", ".tar", ".gz", ".bz2", ".xz",
     ".odt", ".ods", ".odp",
+    # extended coverage (animated stickers, matroska, legacy containers)
+    ".mkv", ".mk3d", ".heic", ".tgs", ".flv", ".3gp", ".ogv", ".asf",
+    ".wmv", ".djvu",
 })