fix: require a matching Origin on consent and name the binding cookie per flow (SEC-17, SEC-19)

docs/security.md

@@ -184,8 +184,11 @@ confirmation, `READ_ONLY`, `TOOLSETS`, `DISABLED_TOOLS` and narrow token scopes
 The server is an OAuth 2.1 authorization server for MCP clients (SDK provider, dynamic client
 registration, PKCE S256 required) and a confidential PKCE client of Gitea. Flow: `/authorize`
 parks the request and shows our consent page (client name, redirect URI, warning). Approval
-needs the form CSRF token and the matching `SameSite=Strict` cookie and sets a
-browser-binding cookie (`__Host-` prefixed and `Secure` on https, `HttpOnly`). The Gitea
+needs the form CSRF token, the matching `SameSite=Strict` cookie and a request `Origin` equal
+to the public origin (the `Referer` origin when `Origin` is absent; neither, or `null`, is
+refused). It sets a browser-binding cookie named per flow (`aegis-oauth-flow-<8 hex of the
+state hash>`, `__Host-` prefixed and `Secure` on https, `HttpOnly`), so concurrent sign-ins in
+one browser do not overwrite each other. The Gitea
 callback is completed only in the browser holding that cookie; unknown, expired or replayed
 states never redirect. Pages send `Cache-Control: no-store`, `Referrer-Policy: no-referrer`,
 `X-Frame-Options: DENY` and a CSP with `frame-ancestors 'none'`. Redirect URIs must be https,