When a reverse proxy rewrites Host to its own upstream address — which
happens whenever a separate SPA front-end proxies /api to this backend —
rp_context() derived an RPID that never matched the origin the browser was
actually on, so WebAuthn's RPID-origin check rejected every registration
and login.
Prefer the Origin header's hostname, which proxies do forward, and fall
back to Host for direct access.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
_build_native_multimodal_message() unconditionally embedded images as
native image_url parts, bypassing the agent's image_input_mode config.
Add _resolve_image_input_mode(cfg) helper mirroring the agent's
decide_image_input_mode logic, and wire it into
_build_native_multimodal_message with a new cfg parameter.
When mode resolves to 'text' (explicit aux vision config, or
image_input_mode: text), returns plain string so the agent's
existing text-mode pipeline (vision_analyze) handles images.
Closes#1959
