feat: Z34b restore-by-host + harden web nginx DNS race

Add HMAC restore-by-host for phone-less rebind; resolve gateway at request time and recreate web after stack up.

Co-authored-by: Cursor <cursoragent@cursor.com>

gateway/gateway.go

@@ -44,6 +44,7 @@ func main() {
 			"/api/v1/auth/bind/phone-confirm",
 			"/api/v1/auth/bind/policy",
 			"/api/v1/auth/yuheng/ticket-exchange",
+			"/api/v1/auth/yuheng/restore-by-host",
 			"/api/v1/auth/sms/send",
 			"/api/v1/meta/",
 			"/api/v1/public/",