fix: address code review findings from 2026-08-17

- scope no-cache headers to non-static routes (restore immutable asset caching)
- reset cached rejected MongoDB promise so retries can succeed
- use last X-Forwarded-For entry in Content Editor rate limiter (anti-spoofing)
- remove weak Mongo defaults from compose files (fail loudly on missing env)
- move staging banner text to common.json content
- read APP_PORT from env file in deploy.sh healthcheck
- filter network noise from staging smoke console assertions

Closes MITHOME-48, MITHOME-49, MITHOME-50, MITHOME-51, MITHOME-52, MITHOME-53, MITHOME-54

content-editor.js

@@ -462,10 +462,13 @@ function securityConfigIsValid() {
 
 function getClientAddress(req) {
   // The editor only listens on 127.0.0.1; the staging Nginx proxy supplies this header.
-  // This prevents all remote visitors sharing the proxy address in the rate limiter.
+  // WHY: take the LAST entry. Nginx ($proxy_add_x_forwarded_for) appends the real client
+  // IP to the list, so the first entry may be a spoofed value sent by the client — using
+  // it would let attackers bypass the rate limiter with a fresh "IP" per request.
   const forwarded = req.headers['x-forwarded-for'];
   if (typeof forwarded === 'string' && forwarded.trim()) {
-    return forwarded.split(',')[0].trim();
+    const parts = forwarded.split(',').map(part => part.trim()).filter(Boolean);
+    if (parts.length > 0) return parts[parts.length - 1];
   }
   return req.socket.remoteAddress || 'unknown';
 }
@@ -646,6 +649,7 @@ module.exports = {
   validateContent,
   hasValidCredentials,
   hasValidCsrfToken,
+  getClientAddress,
   securityConfigIsValid,
   csrfToken: CSRF_TOKEN,
 };