Don't ship a personal profile; pin the Worker to the Pages origin

The repo is public and deployed now, so two things needed tightening:

- index.html: DEFAULT_PROFILE is empty instead of a Steam vanity name. The
  page no longer tries to sync somebody else's account on first load, and
  no personal handle ships in the repo. Anyone running it locally keeps
  their profile in localStorage, so existing local use is unaffected.
- steam-proxy-worker.js: ALLOW_ORIGIN pinned to
  https://rain.pages.melonbread.xyz rather than '*', so only the deployed
  page can call the Worker if it is ever deployed.
- README: record the deployment URL and use a neutral example vanity name.

README.md

@@ -14,6 +14,8 @@ A single-file, offline-friendly companion page for 100%-ing **Metal Gear Solid 2
 
 ## Hosting it (GitHub Pages, Netlify, Cloudflare Pages, Neocities…)
 
+**This copy is deployed at <https://rain.pages.melonbread.xyz/la-li-lu-le-lo/>**, served from the `pages` branch of <https://git.melonbread.xyz/rain/la-li-lu-le-lo>.
+
 **The page itself hosts fine as-is.** It is one static HTML file with all the guide data, the 10 area maps and the colour coding baked in, and it stores progress in the browser's `localStorage`. Drop it in a repo, enable Pages, done. No build step, no dependencies.
 
 Two things behave differently on a static host:
@@ -65,11 +67,11 @@ Double-click `index.html`. Everything works except live Steam sync. Note that op
 
 ## Steam sync
 
-- Enter your **vanity name** (e.g. `mrmelonbread`) or **SteamID64** on the **🔄 Steam Sync** tab and hit **Sync now**.
+- Enter your **vanity name** (e.g. `gaben`) or **SteamID64** on the **🔄 Steam Sync** tab and hit **Sync now**.
 - It re-syncs automatically every time the page loads.
 - Achievements you already own get a `STEAM ✓` badge and a blue edge, and are counted as done.
 - Use the **⬇ Missing on Steam** filter on the Achievements tab to see only what is left.
-- Your profile is pre-filled. Clear it with **Forget profile**.
+- No profile is pre-filled in the public repo — type yours on the Steam Sync tab once and it is remembered in this browser.
 
 **If it fails,** the page tells you why. The usual cause is a private profile:
 Steam → your profile → **Edit Profile → Privacy Settings → Game details → Public**.

index.html

@@ -486,8 +486,10 @@ const BIGBOSS      = {"intro":"Three hours, no rations, no kills, no radar, no s
    STATE
    ============================================================ */
 const KEY = 'mgs2mc-guide-v1';
-/* Pre-filled so the page syncs itself on first load. Clear it with "Forget profile". */
-const DEFAULT_PROFILE = 'mrmelonbread';
+/* Optional: a Steam vanity name or SteamID64 to sync on first load.
+   Left empty in the public repo - type your own on the Steam Sync tab instead.
+   (Anyone still running a local copy keeps their saved profile in localStorage.) */
+const DEFAULT_PROFILE = '';
 /* Live Steam sync needs a server (Steam sends no CORS headers). Leave this empty when running
    locally next to steam-sync.py. If you host this page on GitHub Pages / Netlify / Cloudflare,
    deploy steam-proxy-worker.js and paste its URL here to get sync back. */

steam-proxy-worker.js

@@ -18,15 +18,15 @@
  *   4. In index.html, set:   const STEAM_PROXY = 'https://mgs2-steam-proxy.YOURNAME.workers.dev';
  *   5. Done — the page will use it automatically when it is not running on localhost.
  *
- * Optional: change ALLOW_ORIGIN below from '*' to your page's origin to stop anyone else
- * pointing their own page at your Worker.
+ * ALLOW_ORIGIN below is already pinned to the deploying page's origin, so nobody else
+ * can point their own page at this Worker. Add more origins to the list if you need to.
  *
  * The Worker makes exactly one outbound request, to the public Steam Community page for the
  * profile it is asked about. It stores nothing and logs nothing.
  */
 
 const APPID = '2131640';
-const ALLOW_ORIGIN = '*';        // e.g. 'https://yourname.github.io'
+const ALLOW_ORIGIN = 'https://rain.pages.melonbread.xyz';   // only this page may call the Worker
 const UA = 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0 Safari/537.36';
 
 function cors(res) {