secure dev tunnel: strip /__nextjs debug endpoints while keeping HMR

next.config.ts

@@ -1,18 +1,25 @@
 import { NextConfig } from "next";
 
 const nextConfig: NextConfig = {
+  // Next's on-screen dev indicator is a debug affordance, not a feature of the
+  // site, so it stays hidden. Compile/runtime errors are still reported.
+  devIndicators: false,
   // Allow testing the dev server from other devices on the LAN (e.g. a phone).
   // Without this Next.js blocks cross-origin requests to /_next/* dev assets
   // with a 403, which stops the JS from loading and makes the page inert.
   // The HMR WebSocket is checked against this list too: if the tunnel/beta host
   // isn't listed, the socket is rejected and the dev client never hydrates
   // (SSR-only page: stacked icons, dead buttons).
+  //
+  // Keep this list tight — private LAN ranges plus the one exact tunnel host.
+  // A `**.dvorakmortonxd.dev` wildcard would let any subdomain drive the dev
+  // server. Note this only gates assets/HMR; the dangerous `/__nextjs_*` debug
+  // endpoints are stripped by scripts/dev-server.mjs, not by this list.
   allowedDevOrigins: [
-    "192.168.10.124",
+    "127.0.0.1",
     "192.168.*.*",
     "10.*.*.*",
     "beta.dvorakmortonxd.dev",
-    "*.dvorakmortonxd.dev",
   ],
   webpack(config) {
     config.module.rules.push({