Harden security, fix rate-limiting, and rename proxy

- Move admin login lockout from client cookie to AppConfig (DB), keyed
  by hashed client IP — clearing browser cookies no longer bypasses it
- Replace rate-limit $transaction (TOCTOU) with atomic SQL
  INSERT...ON CONFLICT...RETURNING; add stale-entry cleanup on each
  submission to prevent table bloat
- Add 5 s module-level cache for middleware runtime state fetch, reducing
  per-request DB roundtrips
- Rename middleware.ts → proxy.ts to resolve Next.js 16 deprecation
  warning; update test import accordingly
- Require ADMIN_PASSWORD, ADMIN_AUTH_SECRET, ADMIN_BASIC_AUTH_USER, and
  ADMIN_BASIC_AUTH_PASS in docker-compose.yml (:? syntax) — startup
  fails loudly instead of using placeholder defaults
- Add set -e and informative echo lines to Dockerfile CMD for clearer
  startup failure attribution
- Export requireAdminAuth() from lib/admin-auth for centralised use in
  admin pages
- Add CLAUDE.md with architecture notes and working rules

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

lib/contact-guard.ts

@@ -44,28 +44,29 @@ export async function enforceContactRateLimit(settings: ContactProtectionSetting
   const ip = await getClientIpFromHeaders();
   const key = getRateLimitKey(ip, settings.rateLimit.windowMinutes);
 
-  await prisma.$transaction(async (tx) => {
-    const current = await tx.appConfig.findUnique({
-      where: { key },
-      select: { value: true },
-    });
-    const nextCount = parseCount(current?.value) + 1;
+  // Clean up stale rate limit entries (older than 2x the window) to prevent table bloat.
+  const cutoffDate = new Date(Date.now() - settings.rateLimit.windowMinutes * 2 * 60 * 1000);
+  await prisma.$executeRaw`
+    DELETE FROM "AppConfig"
+    WHERE key LIKE ${`${CONTACT_RATE_LIMIT_KEY_PREFIX}:%`}
+    AND "updatedAt" < ${cutoffDate}
+  `;
 
-    if (nextCount > settings.rateLimit.maxRequests) {
-      throw new Error("Too many contact requests. Please try again later.");
-    }
+  // Atomically insert or increment the counter for this IP + window.
+  const result = await prisma.$queryRaw<Array<{ count: number }>>`
+    INSERT INTO "AppConfig" (id, key, value, "createdAt", "updatedAt")
+    VALUES (gen_random_uuid()::text, ${key}, '1', NOW(), NOW())
+    ON CONFLICT (key) DO UPDATE
+    SET value = (CAST("AppConfig".value AS INTEGER) + 1)::text,
+        "updatedAt" = NOW()
+    RETURNING CAST(value AS INTEGER) AS count
+  `;
 
-    await tx.appConfig.upsert({
-      where: { key },
-      update: {
-        value: String(nextCount),
-      },
-      create: {
-        key,
-        value: "1",
-      },
-    });
-  });
+  const count = result[0]?.count ?? 0;
+
+  if (count > settings.rateLimit.maxRequests) {
+    throw new Error("Too many contact requests. Please try again later.");
+  }
 }
 
 export async function verifyTurnstileToken(