[Bug]: Worktree proxy breaks Next.js Server Actions due to mismatched x-forwarded-host

## Operating system

macOS

## Orca version

1.4.181

## Details

### Short summary

Next.js Server Actions return HTTP 500 when an app is opened through Orca's worktree proxy URL. The proxy sends an `x-forwarded-host` value for the upstream localhost server that does not match the browser's `Origin` header, so Next.js rejects the request as an invalid forwarded Server Action request.

### What happened?

For a Next.js 16.2.7 app, regular page navigation through a URL such as:

```text
http://.orca.localhost:/
```

works, but submitting any form backed by a Server Action returns HTTP 500. The server logs show:

```text
`x-forwarded-host` header with value `localhost:` does not match
`origin` header with value `.orca.localhost:`
from a forwarded Server Actions request. Aborting the action.
Error: Invalid Server Actions request.
POST / 500
```

Opening the same app directly at `http://localhost:/` makes the Server Action succeed.

Next.js compares `Origin` and `x-forwarded-host` for forwarded Server Action requests as a CSRF protection. Orca's proxy appears to set `x-forwarded-host` to the upstream `localhost:` instead of preserving the original request host.

### How can we reproduce it?

1. Start a Next.js app that uses a Server Action with `next dev -p `.
2. Open the app through Orca's generated worktree proxy URL.
3. Submit a form that invokes a Server Action.
4. Observe HTTP 500 and `Invalid Server Actions request` in the Next.js server log.
5. Open `http://localhost:/` directly and submit the same form; it succeeds.

### Expected behavior

Server Actions should work through Orca's proxy URL. The proxy should preserve or set `x-forwarded-host` so it matches the original request host used in the browser's `Origin` header.

### Additional context

Next.js `allowedDevOrigins` does not affect this Server Action validation. Configuring `experimental.serverActions.allowedOrigins` per application can weaken the check as a local workaround, but fixing the forwarded host in Orca's proxy would avoid requiring project-specific security configuration.

No repository code, credentials, account identifiers, or proprietary data are included in this report.