change(origin): Origin/Referer 改为 https://3dtank.com/play/（中继上游强制覆盖 + 镜像回源）

- wss_server.js：上游握手头的 origin/referer 不再透传前端值（前端带的是本机 http://localhost:8080），改为强制覆盖为 https://3dtank.com/play/；其余请求头仍整包透传

- serve.js：代理回源（/resources、/config.xml）的 origin/referer 同步改为 https://3dtank.com/play/

3DTank/tools/serve.js

@@ -46,8 +46,8 @@ const UPSTREAM_HEADERS = {
   'user-agent':
     'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0',
   'accept-language': 'zh-CN,zh;q=0.9,en-GB;q=0.8,en;q=0.7,en-US;q=0.6',
-  origin: 'https://3dtank.com',
-  referer: 'https://3dtank.com/',
+  origin: 'https://3dtank.com/play/',
+  referer: 'https://3dtank.com/play/',
 };
 
 const MIME = {

3DTank/tools/wss_server.js

@@ -94,8 +94,8 @@ const Ws = RequireWs();
 const UPSTREAM_HEADERS = {
   'user-agent':
     'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0',
-  origin: 'https://3dtank.com',
-  referer: 'https://3dtank.com/',
+  origin: 'https://3dtank.com/play/',
+  referer: 'https://3dtank.com/play/',
 };
 
 // 命令名（入口层已从源码确证；ID 可跨方向复用，故按方向区分）
@@ -530,8 +530,10 @@ WsServer.on('connection', (Client, Req) => {
     UpHeaders[L] = Req.headers[K];
   }
   if (!UpHeaders['user-agent']) UpHeaders['user-agent'] = UPSTREAM_HEADERS['user-agent'];
-  if (!UpHeaders['origin']) UpHeaders['origin'] = UPSTREAM_HEADERS.origin;
-  if (!UpHeaders['referer']) UpHeaders['referer'] = UPSTREAM_HEADERS.referer;
+  // Origin/Referer **强制用真实站点的值**：前端（浏览器）带的是本机地址 http://localhost:8080，
+  // 真实服务器会据此校验来源，必须覆盖，不能透传。
+  UpHeaders['origin'] = UPSTREAM_HEADERS.origin;
+  UpHeaders['referer'] = UPSTREAM_HEADERS.referer;
   const ClientProto = Req.headers['sec-websocket-protocol'];
   const UpProtocols = ClientProto
     ? String(ClientProto).split(',').map(function (S) { return S.trim(); }).filter(Boolean)