allowedOrigins missing https:// scheme when deployed via Coolify - breaks Control UI WebSocket connection

Description

When deploying Openclaw via Coolify (using the official template), the WebSocket connection from the Control UI fails with origin not allowed error, even though the domain is correctly configured.

Root Cause

In /app/scripts/configure.js, the function applyAllowedOrigins() reads COOLIFY_FQDN environment variable to inject as allowed origin:

const rawFqdn = process.env.COOLIFY_FQDN || process.env.COOLIFY_URL;
if (rawFqdn) {
    const cleanFqdn = rawFqdn.replace(/\/+$/, "");
    if (cleanFqdn && !origins.includes(cleanFqdn)) {
      origins.push(cleanFqdn);
    }
}

However, Coolify sets COOLIFY_FQDN=bam.aiagency.ro without the https:// scheme, while the browser connects with https://bam.aiagency.ro as origin. This mismatch causes the WebSocket to be rejected.

Environment

• Openclaw versions tested: 2026.2.6, 2026.4.26, 2026.5.3, latest
• Deployed via Coolify (version 4.0.0-beta.420.6)
• Domain: configured with HTTPS via Traefik with Let's Encrypt

Logs

[configure] injected Coolify origin: bam.aiagency.ro [configure] allowed origins: ["bam.aiagency.ro"] [ws] closed before connect ... origin=https://bam.aiagency.ro/ ... code=1008 reason=origin not allowed (open the Control UI from the gateway host or allow it in gateway.controlUi.allowedOrigins)

Suggested Fix

In configure.js, when injecting the Coolify FQDN, ensure the URL has a scheme:

const rawFqdn = process.env.COOLIFY_FQDN || process.env.COOLIFY_URL;
if (rawFqdn) {
    let cleanFqdn = rawFqdn.replace(/\/+$/, "");
    // Add https:// if no scheme is present
    if (cleanFqdn && !cleanFqdn.match(/^https?:\/\//)) {
        cleanFqdn = `https://${cleanFqdn}`;
    }
    if (cleanFqdn && !origins.includes(cleanFqdn)) {
      origins.push(cleanFqdn);
    }
}

Additionally, also consider injecting both variants (with and without https://) to be safe.

Workaround

Currently, manually patching configure.js in the running container works temporarily but is reset on every container restart/update.

Additional Issues

The same deployment also experiences repeated device pairing required prompts on every page refresh, even with allowInsecureAuth: true set in config. This may be a related authentication flow issue specific to Coolify deployments.