fix(HEL-564): 数据中枢入口固定内网 IP，不再按主机名推导

- 主站桌面端/移动端「数据中枢」入口固定 http://192.168.200.11:8766/admin/
  （XIAOBAI_DATAHUB_URL 仍可覆盖）：域名只反代 8765，推导出的 <域名>:8766 打不开，
  同时避免数据中枢被外网摸到
- 中枢 _review_url 不再从 Host 头推导，统一取 REVIEW_PUBLIC_URL，
  默认 http://192.168.200.11:8765；compose 与 .env.example 示例值同步
- 补回归测试：Host 为域名且未配 REVIEW_PUBLIC_URL 时登录链接仍为固定内网地址
- 文档写明 Cookie 按门牌区分的边界与部署说明

Co-authored-by: multica-agent <github@multica.ai>

xiaobai-datahub/tests/test_admin.py

@@ -16,7 +16,7 @@ from datahub.crypto import SecretVault
 from datahub.httpapp import make_handler
 from datahub.hub import Hub
 from datahub.logutil import JsonFormatter
-from datahub.settings import Settings
+from datahub.settings import DEFAULT_REVIEW_PUBLIC_URL, Settings
 from tests.fixtures import StubSiteAuth, fake_transport
 
 
@@ -87,6 +87,20 @@ class AdminTests(unittest.TestCase):
         self.assertFalse(payload["authenticated"])
         self.assertEqual(payload["login_url"], "http://127.0.0.1:8765/login/")
 
+    def test_login_url_ignores_the_browser_host_header(self) -> None:
+        """HEL-564: the login link is the fixed intranet address.
+
+        Deriving it from Host sent admins to <域名>:8765 under a domain that
+        only proxies the review site, so the console now sticks to
+        REVIEW_PUBLIC_URL (default DEFAULT_REVIEW_PUBLIC_URL).
+        """
+        self.hub.settings.review_public_url = ""
+        req = Request(self.base + "/admin/api/session", headers={"Host": "xiaobaifupan.com"})
+        with self.assertRaises(HTTPError) as ctx:
+            urlopen(req, timeout=5)
+        payload = json.loads(ctx.exception.read().decode())
+        self.assertEqual(payload["login_url"], f"{DEFAULT_REVIEW_PUBLIC_URL}/login/")
+
     def test_non_admin_site_accounts_are_refused(self) -> None:
         self.site_auth.add_session("member-session", StubSiteAuth.MEMBER)
         with self.assertRaises(HTTPError) as ctx: