share_landing falls back to request.host_url which yields scheme spoofable by client

Opus finding

share_landing falls back to request.host_url which yields scheme spoofable by client

• backend/app/api/share.py:268-278
• backend/app/api/feed.py:55-66

If Config.PUBLIC_BASE_URL is unset, share.py and feed.py blindly trust X-Forwarded-Host / X-Forwarded-Proto from incoming requests. An attacker can send these headers (when Flask is exposed without a normalising reverse proxy) to make the rendered OG og:url and feed atom self-link point at attacker-controlled hosts, which is then served back to clients/scrapers. Pure header spoofing won't compromise the server, but it weaponises the share page into an open redirect / spoofed OG card. Feed.py has same issue.