feat: complete v0.5 operations foundation

lib/security.ts

@@ -0,0 +1,15 @@
+function requestOrigin(request: Request) {
+  const proto = request.headers.get("x-forwarded-proto") || new URL(request.url).protocol.replace(":", "");
+  const host = request.headers.get("x-forwarded-host") || request.headers.get("host") || new URL(request.url).host;
+  return `${proto}://${host}`;
+}
+
+/** Browser form POSTs and fetch requests must originate from this Hub. */
+export function requireSameOrigin(request: Request) {
+  const origin = request.headers.get("origin");
+  if (!origin || origin !== requestOrigin(request)) throw new Error("Invalid request origin");
+}
+
+export function clientIp(request: Request) {
+  return request.headers.get("x-forwarded-for")?.split(",")[0].trim() || request.headers.get("x-real-ip") || "unknown";
+}