Without trustProxies(), Laravel didn't know requests arriving via
Traefik were originally HTTPS, so route()/url() generated http://
links (stream/proxy, vtt-proxy, etc.), which browsers block as mixed
content on the HTTPS page. Also corrected APP_URL in Coolify's env
vars from http://localhost/ to https://animexe.com.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
proxyUrl() in player.blade.php listed aniziumserver.sbs/site/com in
DIRECT_CORS_HOSTS, so it unwrapped the server's /stream/proxy URLs and
tried loading them directly from the browser. That CORS assumption is
no longer true (confirmed via browser console), which silently undid
the PlayerController fix from the previous commit.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
videoSourcesData (quality/dub failover list) wasn't routed through
stream.proxy, so switching quality/dub hit Anizium's CDN directly and
got blocked by CORS. aniziumserver.sbs was also wrongly whitelisted as
CORS-safe in isOwn — it isn't, per browser console evidence.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
