Pure ASGI middleware restores streaming, socket reconnect fix lands

Open WebUI's SecurityHeadersMiddleware is now pure ASGI, the last middleware still subclassing BaseHTTPMiddleware after CommitSession, AuthToken, WebsocketUpgradeGuard, and Redirect were moved earlier [1]. BaseHTTPMiddleware re-buffers response bodies through an anyio task group, which has known issues with streaming and Content-Length-bearing responses such as the FileResponse from /api/v1/audio/speech. The reimplementation stamps the configured headers directly on the ASGI response, so those responses no longer get buffered or corrupted.

A separate fix addresses socket reconnect recovery for chats started from the home page [2]. When a chat starts there, the URL switches to /c/{id} via history.replaceState, so the Chat component never remounts and chatIdProp stays empty; both websocket recovery paths, handleSocketConnect and chat:active fallback, were gated on chatIdProp and never ran. After any websocket drop during a response, such as mobile backgrounding, these chats now recover as intended. The change is related to polling, but the exact mechanism is not described.

Tool result embeds also got a fix restoring prompt confirmation [3]. FullHeightIframe renders them as srcdoc iframes without allow-same-origin, so their postMessage events carry the opaque origin "null". The trust gate in Chat.svelte only accepted same-origin sources or the global iframeSandboxAllowSameOrigin opt-in, so input:prompt, input:prompt:submit, and action:submit from Open WebUI's own embeds were silently dropped before reaching the confirm dialog. The dialog now fires again for these cross-origin embeds.

Japanese translation updates also landed, but contain no functional changes [4].