fix: preserve original host through forward auth

.publish/helpers/README.md

@@ -44,6 +44,11 @@ Always list the application hosts that are valid redirect destinations. Forwarde
 headers are rejected when `allowedHosts` is absent or does not match, preventing an open
 redirect. A callback can support dynamic tenant domains:
 
+The SSO hostname is the login destination, not an `allowedHosts` entry. For example,
+when protecting `admin.localhost:3000`, keep `admin.localhost:3000` in the allowlist even
+though the verifier runs at `sso.localhost:3000`. WRNexus preserves both hosts across a
+nested gateway request.
+
 ```ts
 allowedHosts: (host) => host.endsWith(".example.test");
 ```

.publish/helpers/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/helpers",
-  "version": "0.2.21",
+  "version": "0.2.22",
   "type": "module",
   "description": "Safe convenience helpers for WrNexus request contexts and common application flows.",
   "license": "MIT",
@@ -21,7 +21,7 @@
     }
   },
   "dependencies": {
-    "@wrnexus/core": "^0.2.21"
+    "@wrnexus/core": "^0.2.22"
   },
   "files": [
     "dist"