fix(website): serve previews on the preview host instead of bouncing them back

Greptile caught what my own matrix could not: the previous fix made
`ema.tnsor.network/preview/888/` redirect to `nostream.dev/preview/888/`, whose
preview rule redirects to `ema.tnsor.network/preview/888/` - a two-host
browser redirect loop. Neither hop reaches the preview worker.

The matrix reported "preview host: redirect to canonical 301 ..." as correct.
It is not: one hop is only correct if the destination serves the page, and the
destination's own rule sends it back. The check that catches this class is
walking the chain the way a browser does, not asserting a single hop - which is
what this commit adds to the reasoning, and what the evidence below records.

A preview path on PREVIEW_HOST is now served in place by the proxy branch;
every other authority still converges on the canonical host, and previews on
the production host still move to PREVIEW_HOST once, then stop there.

Chain walks, six starts, no path revisits a URL:

  ema.../preview/888/                 -> 404        (proxied, one hop, terminal)
  ema.../preview/888/docs/x?y=1       -> 404        (query and path preserved)
  http://ema.../preview/888/          -> https ema  -> 404
  ema.../about                        -> nostream.dev/about -> 200
  nostream.dev/preview/888/           -> ema.../preview/888/ -> 404
  nostream.dev/about                  -> 200
  www.nostream.dev/                   -> nostream.dev/ -> 200

Author: chappie-daemon

website/site/worker/router.ts

@@ -67,7 +67,11 @@ export default {
         // site's own address, with its own links.
         return redirect(new URL(`${url.protocol}//${PREVIEW_HOST}${url.pathname}${url.search}`))
       }
-      if (!onCanonical) {
+      // A preview on PREVIEW_HOST is served HERE, by the proxy branch below.
+      // Bouncing it to the canonical host would only send it back again: that
+      // host redirects every preview to PREVIEW_HOST, so the pair of rules is
+      // a loop rather than a redirect.
+      if (!onCanonical && !(m && url.host.toLowerCase() === PREVIEW_HOST)) {
         // Every other authority converges on the canonical one, preview paths
         // included: only PREVIEW_HOST serves a preview, and it is reached
         // through the canonical origin like everything else.