fix: ensure correct middleware order and path-based gatekeeper origins

.gitea/workflows/deploy.yml

@@ -232,15 +232,20 @@ jobs:
             AUTH_MIDDLEWARE="$STD_MW"
             COMPOSE_PROFILES=""
           else
-            AUTH_MIDDLEWARE="${PROJECT_NAME}-auth,$STD_MW"
+            # Order: Ratelimit -> Forward (Proto) -> Auth -> Compression
+            AUTH_MIDDLEWARE="${PROJECT_NAME}-ratelimit,${PROJECT_NAME}-forward,${PROJECT_NAME}-auth,${PROJECT_NAME}-compress"
             COMPOSE_PROFILES="gatekeeper"
           fi
           AUTH_MIDDLEWARE_UNPROTECTED="$STD_MW"
 
+          # Gatekeeper Origin
+          GATEKEEPER_ORIGIN="$NEXT_PUBLIC_BASE_URL/gatekeeper"
+
           cat > .env.deploy << EOF
           # Generated by CI - $TARGET
           IMAGE_TAG=$IMAGE_TAG
           NEXT_PUBLIC_BASE_URL=$NEXT_PUBLIC_BASE_URL
+          GATEKEEPER_ORIGIN=$GATEKEEPER_ORIGIN
           SENTRY_DSN=$SENTRY_DSN
           LOG_LEVEL=$LOG_LEVEL
           MAIL_HOST=$MAIL_HOST