fix: address code review findings from 2026-08-17

- scope no-cache headers to non-static routes (restore immutable asset caching)
- reset cached rejected MongoDB promise so retries can succeed
- use last X-Forwarded-For entry in Content Editor rate limiter (anti-spoofing)
- remove weak Mongo defaults from compose files (fail loudly on missing env)
- move staging banner text to common.json content
- read APP_PORT from env file in deploy.sh healthcheck
- filter network noise from staging smoke console assertions

Closes MITHOME-48, MITHOME-49, MITHOME-50, MITHOME-51, MITHOME-52, MITHOME-53, MITHOME-54

proto/src/lib/mongodb.test.ts

@@ -139,5 +139,23 @@ describe('MongoDB Connection (Unit Tests)', () => {
       // Should be the same client instance
       expect(client1).toBe(client2)
     })
+
+    it('should not cache a rejected connection promise and retry on next call', async () => {
+      // First attempt fails (e.g. transient DB outage at startup)
+      const failingClient = {
+        connect: jest.fn().mockRejectedValueOnce(new Error('transient failure')),
+        db: jest.fn(),
+        close: jest.fn()
+      }
+      MockedMongoClient.mockImplementation(() => failingClient)
+
+      const { getClientPromise } = await import('./mongodb')
+
+      await expect(getClientPromise()).rejects.toThrow('transient failure')
+
+      // Second call must retry instead of replaying the cached rejection
+      failingClient.connect.mockResolvedValueOnce(failingClient as any)
+      await expect(getClientPromise()).resolves.toBe(failingClient)
+    })
   })
 })

proto/src/lib/mongodb.ts

@@ -24,13 +24,24 @@ export function getClientPromise(): Promise<MongoClient> {
     // @ts-expect-error - Global variable for development hot reload
     if (!global._mongoClientPromise) {
       // @ts-expect-error - Global variable for development hot reload
-      global._mongoClientPromise = createClientPromise()
+      global._mongoClientPromise = createClientPromise().catch((error: Error) => {
+        // A rejected promise must not stay cached: a transient failure would
+        // otherwise break every subsequent request in this process.
+        // @ts-expect-error - Global variable for development hot reload
+        global._mongoClientPromise = undefined
+        throw error
+      })
     }
     // @ts-expect-error - Global variable for development hot reload
     return global._mongoClientPromise
   }
 
-  clientPromise ??= createClientPromise()
+  clientPromise ??= createClientPromise().catch((error: Error) => {
+    // See the development branch above: drop the cached rejection so the next
+    // call can retry the connection.
+    clientPromise = undefined
+    throw error
+  })
   return clientPromise
 }