WebSocket rejected with "invalid Origin" behind reverse proxy, even when Origin exactly matches Host header

Environment

• SiYuan version: v3.8.3
• Deployment: Docker (b3log/siyuan), Synology NAS
• Reverse proxy: Nginx Proxy Manager (NPM), custom domain via SNI + Let's Encrypt/custom certificate
• Access URL: https://siyuan.**.com:8446 (external port mapped to container's internal 443/80)

Problem
When accessing SiYuan through a reverse proxy using a custom domain, the WebSocket connection is always rejected with:

W ... session.go:317: invalid Origin [https://siyuan.**.com:8446] for session auth [ip=172.17.0.1]
E ... serve.go:1697: handle command failed: websocket: request origin not allowed by Upgrader.CheckOrigin

This happens repeatedly and the frontend shows the "connection to the kernel has been lost" error, looping every few seconds.

What I've already verified/ruled out

1. The reverse proxy correctly forwards /ws with WebSocket upgrade headers (Upgrade, Connection: upgrade, proxy_http_version 1.1) — confirmed via browser DevTools Network tab, the request headers are correct.
2. The Origin header sent by the browser (https://siyuan..com:8446) is IDENTICAL to the Host header (siyuan..com:8446) — confirmed via DevTools.
3. TLS/SNI handshake to the reverse proxy is successful and returns the correct certificate (verified with openssl s_client).
4. Direct access via internal IP (http://192.168.x.x:6806) works perfectly — WebSocket connects, no Origin errors.
5. Tried starting the kernel with the --ssl flag (serve --workspace=... --accessAuthCode=... --ssl) — no change, same error.
6. kernel serve --help shows no flag for trusted/allowed origins (no --trustedOrigins, --cors, or similar).

Startup command
serve --workspace=/siyuan/workspace/ --accessAuthCode=xxx

Question
Is there any supported way (config file field, env variable, or hidden flag) to allow additional trusted Origins for the WebSocket CheckOrigin check when SiYuan is served behind a reverse proxy with a custom domain?

The official docs mention "Configure the WebSocket reverse proxy for /ws" for hiding port 6806, which I've done correctly (confirmed via headers), but the kernel still rejects the Origin at the application level regardless of proxy configuration. This suggests the CheckOrigin logic (in kernel/model/session.go) may not read the Host header or any config to determine trusted origins dynamically — it appears to reject anything other than a fixed/expected value.

Any guidance would be appreciated. Happy to provide more logs/config if needed.