Trust the single nginx reverse-proxy hop (confirmed in deploy.md) so
express-rate-limit's per-client bucketing on POST /admin/login sees the
real client IP instead of nginx's. Also fix a dead cookieSecure check
(NODE_ENV === 'secure' never matched) so the session cookie actually
gets Secure in production, verified live with X-Forwarded-Proto: https.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>