[goastler]

What changed

• The domain middleware rejects a request (400 SITE_KEY_INVALID) if the body's dapp isn't the same as the prosopo-site-key header.

Why

• The origin check used the header, but the handlers used the body. From any website you could put your own key (or a test key, which skips the check) in the header and a victim's key in the body.

Effect

• Challenges can only be requested for the site key whose domain check passed.
• Every widget package sends the same key in both places, so normal traffic is unaffected.

Tests

• 5 new cases added to the existing domainMiddleware tests (matching key, another site's key, a non-string key, a victim key behind a test-key header, no body key). The 3 attack cases fail on main; 21/21 pass now.
• Full provider unit suite passes (the 2 failures are macOS-only: /proc and the Linux native addon).
• Manual (before the merge with main): attacker origin + victim key in body got a challenge (200) on main, 400 with this change. Normal requests still get 200.