feat(lotus): accept decorations from chat.lotusguild.org (matrix #22)

Decorations moved off Nextcloud to https://chat.lotusguild.org/decorations.
Add that origin to ALLOWED_DECORATION_ORIGINS (first, so tests use it);
keep drive.lotusguild.org until no host build points there.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

src/lotus/lotusDecorations.test.ts

@@ -83,6 +83,36 @@ test("[lotus #28] safeImageUrl only accepts the pinned decoration CDN origin (or
   stop();
 });
 
+test("[matrix #22] both the new decoration host and the old Nextcloud one are accepted", () => {
+  const stop = startLotusDecorations();
+  const { result } = renderHook(() => useLotusDecoration("@alice:example.org"));
+
+  pushDecorations({
+    "@alice:example.org":
+      "https://chat.lotusguild.org/decorations/joystick.png",
+  });
+  expect(result.current).toBe(
+    "https://chat.lotusguild.org/decorations/joystick.png",
+  );
+
+  pushDecorations({
+    "@alice:example.org":
+      "https://drive.lotusguild.org/public.php/dav/files/x/cinny-decorations/joystick.png",
+  });
+  expect(result.current).toBe(
+    "https://drive.lotusguild.org/public.php/dav/files/x/cinny-decorations/joystick.png",
+  );
+
+  // A look-alike subdomain is a different origin.
+  pushDecorations({
+    "@alice:example.org":
+      "https://chat.lotusguild.org.evil.example/joystick.png",
+  });
+  expect(result.current).toBeUndefined();
+
+  stop();
+});
+
 test("[lotus #17] the roster survives a handler remount within the same page session", () => {
   const stop1 = startLotusDecorations();
   pushDecorations({

src/lotus/lotusDecorations.ts

@@ -45,7 +45,11 @@ export function useLotusDecoration(userId: string): string | undefined {
 // to the actual decoration CDN origin(s) — cinny's `DECORATION_CDN`
 // (`avatarDecorations.ts`) — plus `blob:`, which EC itself may use for local
 // previews. Exported so a future CDN move is a one-line edit here.
+//
+// matrix #22: decorations moved off Nextcloud to chat.lotusguild.org/decorations
+// (first entry). drive.lotusguild.org stays until no host build points there.
 export const ALLOWED_DECORATION_ORIGINS: readonly string[] = [
+  "https://chat.lotusguild.org",
   "https://drive.lotusguild.org",
 ];