web: link the GPL source from the play page; normalise gateway config

The browser footer links the public repository. ZAGAN_WEB_ORIGIN is lowercased for origin matching, and the pinned fingerprint accepts the colon-separated form operators often copy.

3 files changed, 18 insertions, 2 deletions

diff --git a/web/play/index.html b/web/play/index.html
index 7cb902f..59a302b 100644
--- a/web/play/index.html
+++ b/web/play/index.html
@@ -88,6 +88,9 @@
       <div id="history-body"></div>
     </section>
   </main>
+  <footer class="site-foot">
+    Play-money only · built from <a href="https://git.2137697.xyz/zagan-bet.git">the GPL source</a>
+  </footer>
 </div>
 
 <div id="toasts" aria-live="polite"></div>
diff --git a/web/play/style.css b/web/play/style.css
index 20842d2..e05f551 100644
--- a/web/play/style.css
+++ b/web/play/style.css
@@ -356,6 +356,16 @@ td.pos { color: var(--win); }
 td.neg { color: var(--loss); }
 
 /* Toasts and overlays */
+.site-foot {
+  width: min(1240px, 100%);
+  margin: 0 auto;
+  padding: 0 24px 28px;
+  color: var(--faint);
+  font-family: var(--mono);
+  font-size: 11px;
+}
+.site-foot a { color: var(--dim); }
+
 #toasts { position: fixed; right: 18px; bottom: 18px; display: grid; gap: 8px; z-index: 50; width: min(380px, calc(100vw - 36px)); }
 .toast {
   background: var(--surface);
diff --git a/webd/src/config.rs b/webd/src/config.rs
index d3ada8f..44ce4ec 100644
--- a/webd/src/config.rs
+++ b/webd/src/config.rs
@@ -34,11 +34,14 @@ impl Config {
         if !origin.starts_with("http://") && !origin.starts_with("https://") {
             return Err("ZAGAN_WEB_ORIGIN must start with http:// or https://".to_string());
         }
-        let origin = origin.trim_end_matches('/').to_string();
+        let origin = origin.trim_end_matches('/').to_ascii_lowercase();
 
         let upstream = value("ZAGAN_UPSTREAM", DEFAULT_UPSTREAM);
         let fingerprint = required("ZAGAN_UPSTREAM_FINGERPRINT")?;
-        let fingerprint = fingerprint.trim().to_ascii_lowercase();
+        let fingerprint = fingerprint
+            .trim()
+            .replace([':', ' ', '-'], "")
+            .to_ascii_lowercase();
         if fingerprint.len() != 64 || !fingerprint.bytes().all(|byte| byte.is_ascii_hexdigit()) {
             return Err(
                 "ZAGAN_UPSTREAM_FINGERPRINT must be the 64-character SHA-256 of the upstream SPKI"