Clarify canonical Web Origin setup

[jremick]

Summary

• replace the opaque cross-site rejection with actionable canonical Web Origin recovery guidance
• make direct Unraid installs explicitly IP-canonical when using Docker Manager's WebUI shortcut, while documenting the separate hostname/HTTPS path
• lock the Unraid template, upgrade guide, manual candidate evidence, and client error propagation with regression contracts
• preserve exact-origin CSRF enforcement without changing guard logic, exemptions, cookies, CORS, proxy handling, or authentication behavior

This fixes the beta-candidate failure where the app could be opened through a raw-IP alias while MOODARR_WEB_ORIGIN used a hostname: pages and token exchange could appear healthy, but Finder's cookie-authenticated search was correctly rejected.

Verification

• npm run verify:release — 47 files / 690 tests, lint, typecheck, documentation contracts, secret scans, builds, recommendation evaluation, MoodRank release readiness, packaging, and container smoke all passed
• focused tests/app.test.ts and tests/clientApi.test.ts — 120 tests passed
• npm audit --omit=dev — 0 vulnerabilities
• independent frontend review — GO
• independent Unraid/MediaNAS packaging review — GO
• independent security rereview — GO, no findings
• git diff --check

Safety

• No Plex, Seerr, OpenAI, admin tokens, private hostnames, screenshots, or support bundles are included.
• Plex library and catalog access remain read-only; any Watchlist write stays explicit and user-initiated.
• Seerr request creation remains explicit and confirmed.
• The response exposes neither the configured nor received origin.
• Default release authentication is represented with MOODARR_ADMIN_AUTO_SESSION=false and explicit admin-token exchange.

Release handling

• this source/runtime/template change requires a replacement exact-digest beta candidate after merge
• do not promote or reuse the abandoned candidate
• do not mutate EXP or replace the currently running MediaNAS c7b validation instance until the replacement candidate is ready
• semantic tag, semantic GHCR tag, and GitHub release remain outside this PR and require explicit Tier 3 approval