Harden security, fix rate-limiting, and rename proxy

- Move admin login lockout from client cookie to AppConfig (DB), keyed
  by hashed client IP — clearing browser cookies no longer bypasses it
- Replace rate-limit $transaction (TOCTOU) with atomic SQL
  INSERT...ON CONFLICT...RETURNING; add stale-entry cleanup on each
  submission to prevent table bloat
- Add 5 s module-level cache for middleware runtime state fetch, reducing
  per-request DB roundtrips
- Rename middleware.ts → proxy.ts to resolve Next.js 16 deprecation
  warning; update test import accordingly
- Require ADMIN_PASSWORD, ADMIN_AUTH_SECRET, ADMIN_BASIC_AUTH_USER, and
  ADMIN_BASIC_AUTH_PASS in docker-compose.yml (:? syntax) — startup
  fails loudly instead of using placeholder defaults
- Add set -e and informative echo lines to Dockerfile CMD for clearer
  startup failure attribution
- Export requireAdminAuth() from lib/admin-auth for centralised use in
  admin pages
- Add CLAUDE.md with architecture notes and working rules

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/middleware.test.ts

@@ -63,7 +63,7 @@ describe("middleware locale runtime config", () => {
       })),
     );
 
-    const { default: middleware } = await import("../middleware");
+    const { default: middleware } = await import("../proxy");
     const request = createMockRequest("https://example.com/");
 
     await middleware(request as never);
@@ -89,7 +89,7 @@ describe("middleware locale runtime config", () => {
       }),
     );
 
-    const { default: middleware } = await import("../middleware");
+    const { default: middleware } = await import("../proxy");
     const request = createMockRequest("https://example.com/");
 
     await middleware(request as never);
@@ -113,7 +113,7 @@ describe("middleware locale runtime config", () => {
       })),
     );
 
-    const { default: middleware } = await import("../middleware");
+    const { default: middleware } = await import("../proxy");
     const request = createMockRequest("https://example.com/");
 
     const response = await middleware(request as never);
@@ -136,7 +136,7 @@ describe("middleware locale runtime config", () => {
       })),
     );
 
-    const { default: middleware } = await import("../middleware");
+    const { default: middleware } = await import("../proxy");
     const request = createMockRequest("https://example.com/");
 
     await middleware(request as never);