fix(web): allow ?lang and /logs through prod API proxy allowlist

server.cjs

@@ -1586,6 +1586,15 @@ function allowedApiTarget(req) {
   }
 
   if (/^\/api\/tss\/games\/[A-Za-z0-9_-]{1,96}$/.test(pathname)) {
+    const keys = [...params.keys()]
+    const lang = params.get('lang') || 'en'
+    if (keys.some((key) => key !== 'lang') || !/^[A-Za-z-]{2,8}$/.test(lang)) {
+      return null
+    }
+    return url
+  }
+
+  if (/^\/api\/tss\/games\/[A-Za-z0-9_-]{1,96}\/logs$/.test(pathname)) {
     if ([...params.keys()].length) return null
     return url
   }