fix: use public origins for SSO redirects

packages/dev-server/test/gateway.test.ts

@@ -85,6 +85,18 @@ test("forward auth describes the original gateway request", () => {
   expect(headers.get("authorization")).toBe("Bearer token");
 });
 
+test("forward auth uses the protected app public protocol", () => {
+  const headers = forwardAuthHeaders(
+    new Request("http://127.0.0.1:10050/settings", {
+      headers: { host: "admin.wrnx.in" },
+    }),
+    "https://admin.wrnx.in",
+  );
+
+  expect(headers.get("x-original-host")).toBe("admin.wrnx.in");
+  expect(headers.get("x-original-proto")).toBe("https");
+});
+
 test("nested SSO proxy keeps the protected app's original request headers", () => {
   const authHeaders = forwardAuthHeaders(
     new Request("http://admin.localhost:3000/settings", {