Don't ship a personal profile; pin the Worker to the Pages origin

The repo is public and deployed now, so two things needed tightening:

- index.html: DEFAULT_PROFILE is empty instead of a Steam vanity name. The
  page no longer tries to sync somebody else's account on first load, and
  no personal handle ships in the repo. Anyone running it locally keeps
  their profile in localStorage, so existing local use is unaffected.
- steam-proxy-worker.js: ALLOW_ORIGIN pinned to
  https://rain.pages.melonbread.xyz rather than '*', so only the deployed
  page can call the Worker if it is ever deployed.
- README: record the deployment URL and use a neutral example vanity name.

steam-proxy-worker.js

@@ -18,15 +18,15 @@
  *   4. In index.html, set:   const STEAM_PROXY = 'https://mgs2-steam-proxy.YOURNAME.workers.dev';
  *   5. Done — the page will use it automatically when it is not running on localhost.
  *
- * Optional: change ALLOW_ORIGIN below from '*' to your page's origin to stop anyone else
- * pointing their own page at your Worker.
+ * ALLOW_ORIGIN below is already pinned to the deploying page's origin, so nobody else
+ * can point their own page at this Worker. Add more origins to the list if you need to.
  *
  * The Worker makes exactly one outbound request, to the public Steam Community page for the
  * profile it is asked about. It stores nothing and logs nothing.
  */
 
 const APPID = '2131640';
-const ALLOW_ORIGIN = '*';        // e.g. 'https://yourname.github.io'
+const ALLOW_ORIGIN = 'https://rain.pages.melonbread.xyz';   // only this page may call the Worker
 const UA = 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0 Safari/537.36';
 
 function cors(res) {