SIS ↔ Frappe LMS — proxy risk gate

Proves session cookies land on this origin through the Next.js rewrite proxy, so the SIS and the reused LMS player can share one session.