Re-gate same-origin video delivery per app (undo 3b88f13, capacity)

[switch-urfit]

Why

Unconditional same-origin delivery (3b88f13) routed every tenant's video manifests/segments through this service; the prod ECS swap to sha-a65bafb was rolled back for capacity. This restores the per-app gate so the integrated path is opt-in.

What

• Clean revert of 3b88f13 on top of release — isSameOriginMediaApp (app_setting cdn.same_origin='1') decides per request; default = original CloudFront URLs, zero media bytes through ECS
• Keeps a65bafb (User-Agent forward) and 5589469 (SSRF constraint)
• Same switch as lodestar-app-backend PR #384: one setting per tenant turns static + video integrated

Rollout

• Merge → image sha-<commit> builds automatically; prod ECS swap stays manual
• qiuzhen needs app_setting (qiuzhen, cdn.same_origin, '1') at cut-over; without the row it just stays on CloudFront (safe either way)
• With this + PR #384 merged, the capacity failure mode of 08-28 structurally cannot recur

🤖 Generated with Claude Code

[switch-urfit]

CI note: Test on Push is red on every push of this repo since at least 2026-08-06 (release tip a65bafb fails at Unit Testing). This branch's first run additionally died earlier at Build Docker Stack — bitnami/postgresql:latest pull failed against Docker Hub (auth/token error; unrelated to the 3-file revert). Re-ran the workflow; treat the pre-existing red as the baseline when reviewing.

[switch-urfit]

CI rerun update: past the Docker Hub flake, the run now fails at Unit Testing with exactly the baseline's failing suites — activity.controller.spec.ts + activity.service.spec.ts, identical to release@a65bafb (the image that ran in prod). The reverted video.service.spec.ts passes. Net: this PR is at CI parity with the release tip; zero new failures.