v0.17.3: bug-fix maintenance pass — ingest origin exemption, FK safety, auto-search reset, deterministic ingest, WAL, config centralization, dead-code removal

- /api/ingest exempt from origin check for CLI/Bearer clients
- recreate deleted conversations on bogus conversation_id (chat + search)
- augmented auto-search emits reset:true; frontend clears first-pass text
- image uploads stored as placeholders, never text-ingested
- check_fact_conflicts requires shared subject keywords
- deterministic ingest point ids (md5 chunk hash)
- get_load() no longer crashes when rocm-smi yields no VRAM lines
- SQLite WAL + busy_timeout; timing-safe API key compares
- supervise fire-and-forget auto-ingest tasks; log missing logprobs
- centralize EMBED_URL/EMBED_MODEL/QDRANT_URL/NODE_NAME in config
- remove dead triage.py, select_node tests, is_state_changing, stray artifacts
- add regression tests + autouse global-reset conftest

app.py

@@ -22,7 +22,7 @@ from hardware import assess_hardware
 from memory import get_memory_count
 from security import (
     get_client_ip, is_ip_allowed, check_rate_limit, rate_policy,
-    origin_allowed, is_state_changing, request_body_limit,
+    origin_allowed, request_body_limit,
     audit_event, customer_error_envelope, log_incident,
 )
 from auth import get_session, is_admin_only, router as auth_router
@@ -141,7 +141,12 @@ async def session_auth_middleware(request: Request, call_next):
         "/api/auth/heartbeat", "/api/auth/guest", "/api/ingest", "/api/hardware",
     }
 
-    if path.startswith("/api/"):
+    # Bearer-token-authenticated endpoints are reached by CLI/terminal tooling
+    # (curl, caic-ingest.sh) that sends no Origin/Referer header — exempt them
+    # from the browser origin check.
+    origin_exempt_paths = {"/api/ingest"}
+
+    if path.startswith("/api/") and path not in origin_exempt_paths:
         if not origin_allowed(request):
             audit_event("origin_check", "denied", ip=ip, role="none",
                         details=f"{request.method} {path}", warning=True)