Configure trust proxy and enable Secure session cookies in production

Trust the single nginx reverse-proxy hop (confirmed in deploy.md) so
express-rate-limit's per-client bucketing on POST /admin/login sees the
real client IP instead of nginx's. Also fix a dead cookieSecure check
(NODE_ENV === 'secure' never matched) so the session cookie actually
gets Secure in production, verified live with X-Forwarded-Proto: https.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

config/express.js

@@ -29,6 +29,15 @@ var cors = require('cors');
 module.exports = function() {
     // Initialize express app
     var app = express();
+
+    // This app always runs behind exactly one reverse proxy (nginx on the same
+    // host, confirmed forwarding X-Forwarded-For/-Proto per deploy.md) in every
+    // real deployment - trust that one hop so req.ip reflects the real client
+    // rather than nginx's own address. The only current consumer is
+    // express-rate-limit's per-client bucketing on POST /admin/login; without
+    // this, every request behind the proxy shares one rate-limit bucket.
+    app.set('trust proxy', 1);
+
     app.use(cors());
 
     app.use(favicon('./public/img/favico1.png'));
@@ -88,7 +97,10 @@ module.exports = function() {
     app.use(cookieParser());
 
     // Express MongoDB session storage
-    if (process.env.NODE_ENV === 'secure') {
+    // Production is only ever served over real HTTPS (nginx terminates TLS in
+    // front of this app) - mark the session cookie Secure there so a browser
+    // never sends it over plain HTTP. Off in dev/test, which run without TLS.
+    if (process.env.NODE_ENV === 'production') {
         var cookieSecure = true;
     } else {
         var cookieSecure = false;