fix: address code review findings from 2026-08-17

- scope no-cache headers to non-static routes (restore immutable asset caching)
- reset cached rejected MongoDB promise so retries can succeed
- use last X-Forwarded-For entry in Content Editor rate limiter (anti-spoofing)
- remove weak Mongo defaults from compose files (fail loudly on missing env)
- move staging banner text to common.json content
- read APP_PORT from env file in deploy.sh healthcheck
- filter network noise from staging smoke console assertions

Closes MITHOME-48, MITHOME-49, MITHOME-50, MITHOME-51, MITHOME-52, MITHOME-53, MITHOME-54

docker-compose.prod.yml

@@ -12,8 +12,9 @@ services:
       - "8080:3000" # Host port 8080 elkerüli a lokális npm dev (3000) összeakadást
     environment:
       - NODE_ENV=production
-      # MONGODB and LOKI URLs should be updated to point to production services
-      - MONGODB_URI=${MONGODB_URI:-mongodb://mongodb:27017/mozdit}
+      # No fallback for MONGODB_URI: with root auth enabled on the Mongo container an
+      # unauthenticated default URI would silently break the app — fail loudly instead.
+      - MONGODB_URI=${MONGODB_URI}
       - MONGODB_DB=${MONGODB_DB:-mozdit}
       - NEXT_PUBLIC_SITE_URL=${NEXT_PUBLIC_SITE_URL:-https://mozdit.hu}
       - NEXT_PUBLIC_COMPANY_NAME=${NEXT_PUBLIC_COMPANY_NAME:-mozdIT Bt.}
@@ -38,7 +39,8 @@ services:
       - "27018:27017" # Host port 27018 elkerüli az összeakadást a lokális Mongo-val
     environment:
       - MONGO_INITDB_ROOT_USERNAME=${MONGO_ROOT_USER:-admin}
-      - MONGO_INITDB_ROOT_PASSWORD=${MONGO_ROOT_PASSWORD:-password123}
+      # No weak default password: a missing value must fail the container loudly.
+      - MONGO_INITDB_ROOT_PASSWORD=${MONGO_ROOT_PASSWORD}
       - MONGO_INITDB_DATABASE=mozdit
     volumes:
       - mongodb_data_prod:/data/db