// Package originauth implements origin-hiding enforcement (doc/05 §2 源站隐藏 /
// 回源鉴权).
//
// The API only ever serves traffic through the CDN. The CDN is configured to
//  1. connect to the origin from a known set of egress IP ranges, and
//  2. inject a shared secret header (default X-Origin-Auth: <random>) on every
//     origin request.
//
// This middleware rejects (403) any request that either does not originate from
// an allowed CDN egress range, or does not carry a recognised auth value — so a
// direct hit on the origin IP, bypassing the CDN, is refused.
//
// Rotation: the auth value is rotated quarterly (doc/06 §6). To make rotation
// zero-downtime the middleware accepts a Current value plus an optional Previous
// value, so both the old and new secret validate during the transition window.
// Comparison is constant-time.
//
// Wiring (not done automatically to keep /healthz reachable for CDN probes):
//
//	mw, err := originauth.New(originauth.FromEnv())
//	if err == nil {
//	    r.Group(func(pr chi.Router) {
//	        pr.Use(mw.Handler)
//	        // ... protected API routes ...
//	    })
//	}
package originauth