feat(gateway): allow secured LAN console access

apps/api/src/canary-runtime.ts

@@ -9,6 +9,8 @@ export interface CanaryRuntimeEnvironment {
   readonly CANARY_DIST_DIR?: string;
   readonly CANARY_PORT?: string;
   readonly CANARY_UPSTREAM_PORT?: string;
+  readonly MULTI_SIMADMIN_GATEWAY_HOST?: string;
+  readonly MULTI_SIMADMIN_GATEWAY_ALLOWED_HOSTS?: string;
   readonly MULTI_SIMADMIN_GATEWAY_TOKEN?: string;
   readonly MULTI_SIMADMIN_CUTOVER_ACK?: string;
 }
@@ -54,5 +56,14 @@ export function readProductionGatewayRuntimeOptions(
     );
   }
   const options = readCanaryRuntimeOptions({ ...environment, CANARY_PORT: '8788' });
-  return Object.freeze({ ...options, ownsProductionPort: true });
+  const host = environment.MULTI_SIMADMIN_GATEWAY_HOST ?? options.host;
+  const allowedHosts = environment.MULTI_SIMADMIN_GATEWAY_ALLOWED_HOSTS?.split(',')
+    .map((value) => value.trim())
+    .filter(Boolean);
+  return Object.freeze({
+    ...options,
+    ...(host === undefined ? {} : { host }),
+    ...(allowedHosts === undefined ? {} : { allowedHosts }),
+    ownsProductionPort: true,
+  });
 }