Merge branch 'dev'

- docker-compose.yml: rspace service now uses
  localhost:3000/jeffemmett/rspace-online:${IMAGE_TAG:-latest} so
  CI's `docker pull ... && docker compose up -d --no-build` actually
  picks up the new image without a manual retag step.
- modules/rpast/mod.ts: base URL defaults to https for any non-loopback
  host, honoring x-forwarded-proto only when set to http|https. Fixes
  "Open in <rApp>" links previously emitted as http:// on CF/Traefik.

docker-compose.yml

@@ -1,6 +1,9 @@
 services:
   rspace:
-    image: rspace-online-rspace:latest
+    # CI pushes to localhost:3000/jeffemmett/rspace-online:<short-sha> and
+    # sets IMAGE_TAG via env when running `docker compose up -d --no-build`.
+    # Falls back to :latest for local rebuilds.
+    image: localhost:3000/jeffemmett/rspace-online:${IMAGE_TAG:-latest}
     # build:
     #   context: .
     #   additional_contexts:

modules/rpast/mod.ts

@@ -51,8 +51,14 @@ async function buildProjection(c: any) {
 
 	// Derive the public base URL from the request so in-timeline "Open in
 	// rApp" links resolve against the same origin the user arrived from.
+	// Default to https — rSpace always runs behind Cloudflare/Traefik TLS in
+	// production. Only fall back to http for loopback dev hosts.
 	const host = c.req.header('x-forwarded-host') ?? c.req.header('host');
-	const proto = c.req.header('x-forwarded-proto') ?? (host?.includes('localhost') ? 'http' : 'https');
+	const isLocal = !host || /^(localhost|127\.|\[::1\])/i.test(host);
+	const forwardedProto = c.req.header('x-forwarded-proto');
+	const proto = forwardedProto === 'http' || forwardedProto === 'https'
+		? forwardedProto
+		: (isLocal ? 'http' : 'https');
 	const baseUrl = host ? `${proto}://${host}` : undefined;
 
 	const sources = await enumerateCreations(space, { modules, from, to });