fix: address code review findings from 2026-08-17

- scope no-cache headers to non-static routes (restore immutable asset caching)
- reset cached rejected MongoDB promise so retries can succeed
- use last X-Forwarded-For entry in Content Editor rate limiter (anti-spoofing)
- remove weak Mongo defaults from compose files (fail loudly on missing env)
- move staging banner text to common.json content
- read APP_PORT from env file in deploy.sh healthcheck
- filter network noise from staging smoke console assertions

Closes MITHOME-48, MITHOME-49, MITHOME-50, MITHOME-51, MITHOME-52, MITHOME-53, MITHOME-54

proto/src/lib/mongodb.test.ts

@@ -139,5 +139,23 @@ describe('MongoDB Connection (Unit Tests)', () => {
       // Should be the same client instance
       expect(client1).toBe(client2)
     })
+
+    it('should not cache a rejected connection promise and retry on next call', async () => {
+      // First attempt fails (e.g. transient DB outage at startup)
+      const failingClient = {
+        connect: jest.fn().mockRejectedValueOnce(new Error('transient failure')),
+        db: jest.fn(),
+        close: jest.fn()
+      }
+      MockedMongoClient.mockImplementation(() => failingClient)
+
+      const { getClientPromise } = await import('./mongodb')
+
+      await expect(getClientPromise()).rejects.toThrow('transient failure')
+
+      // Second call must retry instead of replaying the cached rejection
+      failingClient.connect.mockResolvedValueOnce(failingClient as any)
+      await expect(getClientPromise()).resolves.toBe(failingClient)
+    })
   })
 })