Fix issue where upstream only got the first query param

nginx.conf

@@ -27,13 +27,37 @@ http {
                 rewrite ^ /index.html last;
             }
 
-            proxy_pass $arg_url;
+            # Forward query string to upstream (? if url has no query, & if it already has ?)
+            set $url_sep "?";
+            if ($arg_url ~ \?) {
+                set $url_sep "&";
+            }
+            proxy_pass $arg_url$url_sep$args;
             proxy_http_version 1.1;
             proxy_set_header Host $proxy_host;
             proxy_ssl_server_name on;
 
+            # Strip upstream CORS so we only send our own (duplicate = browser reject)
+            proxy_hide_header Access-Control-Allow-Origin;
+            proxy_hide_header Access-Control-Allow-Methods;
+            proxy_hide_header Access-Control-Allow-Headers;
+            proxy_hide_header Access-Control-Expose-Headers;
+            proxy_hide_header Access-Control-Max-Age;
+
+            # CORS headers — replace with our own *
+            add_header Access-Control-Allow-Origin * always;
+            add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH" always;
+            add_header Access-Control-Allow-Headers "DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,X-Cache,X-NoCache,X-Status" always;
+            add_header Access-Control-Expose-Headers "X-Cache-Status" always;
+
+            # Handle preflight OPTIONS requests
+            if ($request_method = 'OPTIONS') {
+                return 204;
+            }
+
             proxy_cache api_cache;
             proxy_cache_valid 200 201 202 203 204 205 206 207 208 226 365d;
+            proxy_ignore_headers Cache-Control Expires;
 
             proxy_cache_bypass $http_x_nocache;
             proxy_no_cache $http_x_nocache;
@@ -45,6 +69,15 @@ http {
 
         location = /index.html {
             root /usr/share/nginx/html;
+            # CORS headers for HTML interface
+            add_header Access-Control-Allow-Origin * always;
+            add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+            add_header Access-Control-Allow-Headers "DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type" always;
+
+            # Handle preflight OPTIONS requests
+            if ($request_method = 'OPTIONS') {
+                return 204;
+            }
         }
     }
 }