fix: surface install progress behind reverse proxies

oa-backend/src/main/java/com/kaidi/oa/web/HealthController.java

@@ -1,6 +1,7 @@
 package com.kaidi.oa.web;
 
 import com.kaidi.oa.common.ApiResp;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.GetMapping;
@@ -8,6 +9,9 @@ import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 
 import javax.sql.DataSource;
+import java.nio.file.Files;
+import java.nio.file.InvalidPathException;
+import java.nio.file.Path;
 import java.sql.Connection;
 import java.sql.ResultSet;
 import java.sql.Statement;
@@ -19,9 +23,12 @@ import java.util.Map;
 public class HealthController {
 
     private final DataSource dataSource;
+    private final Path installLockFile;
 
-    public HealthController(DataSource dataSource) {
+    public HealthController(DataSource dataSource,
+                            @Value("${ERP_INSTALL_LOCK_FILE:}") String installLockFile) {
         this.dataSource = dataSource;
+        this.installLockFile = resolveInstallLockFile(installLockFile);
     }
 
     @GetMapping("/health")
@@ -30,12 +37,31 @@ public class HealthController {
                 Statement statement = connection.createStatement();
                 ResultSet result = statement.executeQuery("SELECT 1")) {
             if (connection.isValid(2) && result.next() && result.getInt(1) == 1) {
-                return ResponseEntity.ok(ApiResp.ok(Map.of("status", "UP", "database", "UP")));
+                return ResponseEntity.ok(ApiResp.ok(readiness("UP", "UP")));
             }
         } catch (Exception ignored) {
             // Health responses deliberately avoid exposing connection details.
         }
         return ResponseEntity.status(HttpStatus.SERVICE_UNAVAILABLE)
-                .body(new ApiResp<>(50301, "database unavailable", Map.of("status", "DOWN", "database", "DOWN")));
+                .body(new ApiResp<>(50301, "database unavailable", readiness("DOWN", "DOWN")));
+    }
+
+    private Map<String, String> readiness(String status, String database) {
+        return Map.of(
+                "status", status,
+                "database", database,
+                "installLocked", Boolean.toString(installLockFile != null && Files.isRegularFile(installLockFile))
+        );
+    }
+
+    private static Path resolveInstallLockFile(String value) {
+        if (value == null || value.isBlank()) {
+            return null;
+        }
+        try {
+            return Path.of(value).toAbsolutePath().normalize();
+        } catch (InvalidPathException ignored) {
+            return null;
+        }
     }
 }

oa-backend/src/main/resources/application.yml

@@ -1,5 +1,8 @@
 server:
   port: 8090
+  # Reconstruct the public scheme/host when running behind Nginx, Caddy or a
+  # tunnel so same-origin HTTPS requests are not rejected as cross-origin.
+  forward-headers-strategy: framework
 
 spring:
   application: