Fix login loop behind reverse proxy: trust X-Forwarded-Proto

In production we run behind nginx that terminates HTTPS and proxies
HTTP to node:3000. Without app.set('trust proxy', 1) Express sees
the connection as plaintext, so express-session refuses to set the
secure cookie. Login appeared to succeed but no cookie was issued,
causing an immediate redirect back to /login on the next request.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server.js

@@ -18,6 +18,13 @@ const app = express();
 const PORT = process.env.PORT || 3000;
 const isProd = process.env.NODE_ENV === 'production';
 
+// We sit behind nginx/PM2 in production; trust X-Forwarded-* headers so that
+// req.secure reflects the actual client connection (otherwise secure cookies
+// would never be set and rate-limiting would treat every client as the same IP).
+if (isProd) {
+    app.set('trust proxy', 1);
+}
+
 initDatabase();
 
 // Graceful shutdown