Fix proxy trust and attest RFMS runtime identity

[Reedtrullz]

Summary

• trust exactly the single Caddy hop for HTTP and WebSocket client limiting
• deploy the exact CI-tested commit as an immutable local SHA-tagged image
• attest package, commit, image ID, and image ref in health/logs and verify them against Docker state
• restore the previous image automatically if production promotion fails

Validation

• npm run typecheck:all
• npm run lint (0 errors; existing warnings only)
• npm run format:check
• npm run test:coverage (67 files, 857 tests)
• npm run test:e2e:ci (3 smoke tests)
• ansible-playbook --syntax-check -i inventory/hosts.yml ansible-playbook.yml --extra-vars deploy_sha=<40-hex>
• production Docker build and local container health/identity smoke
• npm audit --omit=dev --audit-level=high (no high/critical findings)

Boundaries

• Cloudflare-to-Caddy real-client preservation is not enabled; rate limiting may group by Cloudflare edge, safely avoiding forwarded-header spoofing.
• SHA-tagged image pruning is intentionally not included.
• Promotion has fast rollback but is not zero-downtime.