fix: support proxied origins and update progress

server/app.ts

@@ -651,7 +651,7 @@ export async function buildApp(database: DatabaseContext, config: AppConfig) {
   app.addHook("onRequest", async (request) => {
     if (!unsafeMethods.has(request.method) || !request.url.startsWith("/api/")) return;
     const origin = request.headers.origin;
-    const allowed = new Set([config.publicOrigin]);
+    const allowed = new Set(config.allowedOrigins);
     if (!config.isProduction) {
       allowed.add("http://127.0.0.1:5173");
       allowed.add("http://localhost:5173");
@@ -947,6 +947,8 @@ export async function buildApp(database: DatabaseContext, config: AppConfig) {
       SELECT id, operation, status, version, platform, asset_name AS assetName,
         size_bytes AS sizeBytes, error_message AS errorMessage,
         created_at AS createdAt, updated_at AS updatedAt, completed_at AS completedAt,
+        downloaded_bytes AS downloadedBytes, download_started_at AS downloadStartedAt,
+        download_speed_bps AS downloadSpeedBps,
         requested_at AS applyQueuedAt
       FROM update_jobs WHERE admin_id=? ORDER BY created_at DESC LIMIT 1
     `).get(request.auth!.admin.id) as Record<string, unknown> | undefined;
@@ -1193,6 +1195,8 @@ export async function buildApp(database: DatabaseContext, config: AppConfig) {
       SELECT id, operation, status, version, platform, asset_name AS assetName,
         size_bytes AS sizeBytes, error_message AS errorMessage,
         created_at AS createdAt, updated_at AS updatedAt, completed_at AS completedAt,
+        downloaded_bytes AS downloadedBytes, download_started_at AS downloadStartedAt,
+        download_speed_bps AS downloadSpeedBps,
         requested_at AS applyQueuedAt
       FROM update_jobs WHERE id=? AND admin_id=?
     `).get(id, request.auth!.admin.id) as Record<string, unknown> | undefined;