Fix/webchat authorized domain fail closed (#1028)

* fix(webchat): fail closed when no authorized domains are configured

isOriginAuthorized previously allowed any origin when authorizedDomains
was empty, letting the webchat widget be embedded on unintended sites
before the allow-list was ever configured. Reject cross-origin embeds
in that case; a missing origin (direct, non-embedded access) is still
allowed.

* fix(webchat): restore /webchat as a public route in proxy middleware

/webchat was excluded from the negative-lookahead matcher instead of
being listed in publicRoutes, so it never reached the auth check but
also picked up no session/tenant handling from proxy(). Move it into
publicRoutes and drop it from the matcher exclusion so it goes through
the same public-route path as the other unauthenticated surfaces
(booking, portal/redeem, etc).

Author: realcodesiman

apps/builder/src/proxy.ts

@@ -25,6 +25,7 @@ const publicRoutes = [
   "/extensions",
   "/booking",
   "/portal/redeem",
+  "/webchat",
 ]
 const signinPath = "/auth/sign-in"
 
@@ -118,7 +119,7 @@ function isPublicRoute(pathname: string) {
 
 export const config = {
   matcher: [
-    "/((?!webchat|zalo_verifier|pricing|chat-widget|assets|ws|storage|_next/static|_next/image|favicon.ico|avatars|.*.svg|brand|openapi.json|dynamic-image/).*)",
+    "/((?!zalo_verifier|pricing|chat-widget|assets|ws|storage|_next/static|_next/image|favicon.ico|avatars|.*.svg|brand|openapi.json|dynamic-image/).*)",
     "/api/presigned-upload",
     "/api/whatsapp/:path*",
   ],