release: v1.2.1 — login captcha, docs site, and bug fixes

Add slider captcha for web login, VitePress documentation on GitHub Pages,
and fixes for gallery delete refresh, pagination jump, and copy-format persistence.

docs-site/en/guide/reverse-proxy.md

@@ -0,0 +1,83 @@
+# Reverse proxy
+
+In production, terminate HTTPS with Nginx, Caddy, NPM (Nginx Proxy Manager), or your NAS proxy and forward to PicHost on port **6892**.
+
+## Basics
+
+- Upstream: `http://127.0.0.1:6892` (or host IP)
+- Forward: `Host`, `X-Forwarded-Proto` (and `X-Forwarded-For` as needed)
+- Body size: Nginx `client_max_body_size 12m` or larger
+- Use **HTTPS** on the public edge
+
+## Single domain (Nginx)
+
+Admin, API, and images on one hostname:
+
+```nginx
+server {
+  server_name pic.example.com;
+  location / {
+    proxy_pass http://127.0.0.1:6892;
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    client_max_body_size 12m;
+  }
+}
+```
+
+Optional:
+
+```env
+IMAGE_BASE_URL=https://pic.example.com
+```
+
+Without `IMAGE_BASE_URL`, PicHost infers the public URL from forwarded headers.
+
+## Dual domains
+
+Both hostnames can fully proxy to the same port; isolation is enforced in PicHost middleware.
+
+See [Dual-domain separation](./domain-separation.md).
+
+## Cloudflare orange cloud
+
+Run PicHost on **your server / Docker** (port `6892`). On Cloudflare:
+
+| Practice | Notes |
+| -------- | ----- |
+| **Proxied DNS** | Both admin and image hostnames → origin proxy to `6892`, SSL **Full (strict)** |
+| Preferred edge IPs | Compatible; Host remains your real domain |
+| **R2** | Object storage backend in **Storage**; not the same as hosting the app on Pages |
+| Origin firewall | Allow only [Cloudflare IPs](https://www.cloudflare.com/ips/); do not expose `6892` publicly |
+
+**Avoid:**
+
+- **Cloudflare Pages** (`*.pages.dev`) or **Workers** (`*.workers.dev`) as a **full-site reverse proxy** to PicHost — extra hostnames can bypass dual-domain isolation ([Security notes](./domain-separation.md#security-notes))
+- “Create Worker” from Git on this repo — `node-server` preset is not Workers-ready
+
+## Origin hardening (dual-domain)
+
+PicHost middleware does **not** reject unlisted Host values. Complement with:
+
+1. **`server_name` allowlist** — site + image hosts only; `default_server` blocks bare IP and unknown Host
+2. **Do not expose 6892 on the public Internet** — only local reverse proxy; public 80/443 only
+3. **Orange cloud** — origin firewall limited to Cloudflare IP ranges
+
+## Caddy
+
+```caddy
+pic.example.com {
+  reverse_proxy 127.0.0.1:6892
+}
+```
+
+Add a second site block for the second hostname with the same upstream.
+
+## Caching
+
+Image 404/403 and domain-isolation 404 responses are **no-cache** to avoid sticky CDN errors. Be careful caching API paths behind a CDN.
+
+## See also
+
+- [Environment variables](./configuration.md)
+- [Quick start](./getting-started.md)