feat(cdn): serve the CDN same-origin on every front-proxy vhost

Values an app renders once (env files, branding config, web manifests)
cannot follow the network a page is served on, so onion pages loaded
logos and icons from the clearnet CDN host (Mobilizon, Wazuh, Mini-QR in
run 40243434327). Like the object-store route from 40b178d9a4, every
front-proxy vhost now aliases the CDN directory under /_infinito/cdn/,
with nosniff and a sandboxing CSP so a mirrored HTML or SVG file cannot
script the app's origin. lookup('cdn') and lookup('design') add
relative_urls for consumers that want host-relative URLs; the absolute
urls stay for server-side users. The include lives outside the location
snippets, so test_vhost_cross_cutting_includes requires it of every
override, the compose synapse vhost included.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/unit/python/plugins/lookup/test_cdn.py

@@ -2,7 +2,7 @@ import tempfile
 import unittest
 from pathlib import Path
 
-from plugins.lookup.cdn import _cdn_paths, _to_url_tree
+from plugins.lookup.cdn import SAME_ORIGIN_PATH, _cdn_paths, _to_url_tree
 
 
 class TestCdnPaths(unittest.TestCase):
@@ -78,6 +78,14 @@ class TestCdnToUrlTree(unittest.TestCase):
         urls_without = _to_url_tree(self.tree, self.root, self.base_url)
         self.assertEqual(urls_with["shared"]["css"], urls_without["shared"]["css"])
 
+    def test_same_origin_tree_is_host_relative(self):
+        urls = _to_url_tree(self.tree, self.root, SAME_ORIGIN_PATH)
+        self.assertEqual(urls["root"], "/_infinito/cdn/")
+        self.assertEqual(
+            urls["role"]["release"]["img"],
+            f"/_infinito/cdn/roles/{self.app}/latest/img",
+        )
+
     def test_different_apps_produce_different_role_urls(self):
         tree_other = _cdn_paths(self.root, "web-app-nextcloud", "latest")
         urls_a = _to_url_tree(self.tree, self.root, self.base_url)