fix(og): robust infrastructure fix for OG image check

- Added exhaustive PathRegexp whitelists in docker-compose.yml to bypass Gatekeeper.
- Fixed TRAEFIK_HOST_RULE interpolation in deploy.yml.
- Enhanced scripts/check-og-images.ts with header and body diagnostics.
- Added server-side font loading logs in lib/og-helper.tsx.

docker-compose.yml

@@ -22,7 +22,7 @@ services:
       - "traefik.http.routers.${PROJECT_NAME:-klz-cables}.middlewares=${AUTH_MIDDLEWARE:-${PROJECT_NAME:-klz-cables}-ratelimit,${PROJECT_NAME:-klz-cables}-forward,${PROJECT_NAME:-klz-cables}-compress}"
 
       # Public Router (Whitelist for OG Images, Sitemaps, Health)
-      - "traefik.http.routers.${PROJECT_NAME:-klz-cables}-public.rule=(${TRAEFIK_HOST_RULE:-Host(`klz-cables.com`)}) && (PathPrefix(`/health`, `/sitemap.xml`, `/robots.txt`, `/manifest.webmanifest`, `/api/og`) || PathRegexp(`^/.*opengraph-image$`))"
+      - "traefik.http.routers.${PROJECT_NAME:-klz-cables}-public.rule=PathPrefix(`/health`, `/sitemap.xml`, `/robots.txt`, `/manifest.webmanifest`) || PathRegexp(`.*api/og/.*`) || PathRegexp(`.*opengraph-image$`) || PathRegexp(`.*opengraph-image\\?.*`)"
       - "traefik.http.routers.${PROJECT_NAME:-klz-cables}-public.entrypoints=websecure"
       - "traefik.http.routers.${PROJECT_NAME:-klz-cables}-public.tls.certresolver=le"
       - "traefik.http.routers.${PROJECT_NAME:-klz-cables}-public.tls=true"