docs: update portal for WRNexusJS 0.2.22

public/llms.txt

@@ -1,4 +1,4 @@
-# WRNexusJS documentation 0.2.21
+# WRNexusJS documentation 0.2.22
 
 Status: Private Developer Preview. This site documents 26 release-aligned packages.
 
@@ -281,7 +281,7 @@ wrnexus eject <component>     # copy a Wire UI component's .wrn into app/compone
 
 # Installed package documentation
 
-The following README files and declarations come from the installed private 0.2.21 release.
+The following README files and declarations come from the installed private 0.2.22 release.
 
 ## @wrnexus/ai
 
@@ -4022,6 +4022,11 @@ Always list the application hosts that are valid redirect destinations. Forwarde
 headers are rejected when `allowedHosts` is absent or does not match, preventing an open
 redirect. A callback can support dynamic tenant domains:
 
+The SSO hostname is the login destination, not an `allowedHosts` entry. For example,
+when protecting `admin.localhost:3000`, keep `admin.localhost:3000` in the allowlist even
+though the verifier runs at `sso.localhost:3000`. WRNexus preserves both hosts across a
+nested gateway request.
+
 ```ts
 allowedHosts: (host) => host.endsWith(".example.test");
 ```