Same-origin reverse proxy removes browser CORS for the web build; upstream named per-request via X-Honcho-Upstream header (frontend stays source of truth). Tauri keeps reqwest-absolute. Optional SSRF allowlist, open by default. Preserves existing Fleet aggregation; new aggregation deferred.