#2270 Document allowed_hosts requirement for custom domain / reverse-proxy access

说明

## Context
Production host `hlh-ai-engine-strata` (CT on prox01, 192.168.1.15) serves Strata on port 80 and is reached via the public DNS name `hlh-ai-engine-strata.mizertech.net`.

## Problem
DNS resolved correctly, but every request under the domain returned:

```
403 forbidden: Host 'hlh-ai-engine-strata.mizertech.net' is not allowed (DNS rebinding protection)
```

The only fixes are `allowed_hosts` in the run config, `STRATA_ALLOWED_HOSTS`, or setting an `api_key` — but:
- `allowed_hosts` is **not editable via the web Settings / POST /config** ("'allowed_hosts' cannot be changed here"), so it requires a filesystem edit **and a service restart** — expensive when the model takes ~15 min to load.
- The web UI itself is unreachable under the domain to make that edit (chicken-and-egg 403).

## Resolution (2026-10-13)
Added to `/opt/strata/strata-iq3_s.json`:
```json
"allowed_hosts": ["hlh-ai-engine-strata.mizertech.net", "192.168.1.15", "localhost"]
```
Restarted `strata.service`; domain access now returns 200.

## Outstanding / asks
1. Make `allowed_hosts` editable via `POST /config` (or a dedicated admin route reachable by IP) so it can be changed without a model-reloading restart.
2. Support hot-reload of `allowed_hosts` (SIGHUP or file watch) — host allowlist changes shouldn't require reloading a 34 GB model.
3. The 403 message is good, but the README/SECURITY docs should show a worked example for running behind a custom domain.