Align the legacy v1 bundle publish routes with the scoped Next API protections so older deployment paths stop accepting wildcard origins or host-derived share URLs. Co-authored-by: src-opn <src-opn@users.noreply.github.com>