Reference-image upload, job polling and result download now run on the local IP; only the generate submit egresses via proxy.url. Verified live: submit egress 74.244.159.228 (proxy) vs upload/poll/download 76.209.9.65 (local), 1K adobe gpt image generated OK.
The server session slides its TTL on use but the browser cookie's Max-Age was frozen at login, so it lapsed mid-session and broke cookie-only auth (private image <img>/download loads returned 401) while the SPA still looked logged in via its Bearer token. Re-issue the cookie with a fresh Max-Age whenever an authenticated request carried it.
Derive the 49-byte header seed and the salt F per-session from the grok homepage (browser-free tls-client GET), instead of hardcoding constants that go stale on every grok web rebuild (403 anti-bot). F is reproduced natively in Go (curve keyframe sampling: cubic-bezier easing, color lerp, rotation matrix, JS-exact number->hex). Static constants remain as env-overridable fallback. Adds offline regression test against server-verified ground-truth triples.
chiyi