Fix runtime setup, mapped ports, and proxy trust

[JayRHa]

What changed

• use the page origin for login/setup API calls so Docker port mappings and HTTPS proxies work
• make documented environment variables effective, including DATABASE_URL and production mode
• fix the Windows PowerShell setup parser/runtime errors
• trust forwarding headers only from configured proxy IPs
• create local log directories safely on a fresh checkout
• add focused Python and PowerShell CI checks

Root cause

The login page hard-coded localhost:8000, settings deliberately ignored environment variables, the PowerShell setup mixed Bash syntax with PowerShell, and rate limiting accepted spoofable forwarding headers.

Validation

• 3 passed with the focused pytest suite
• setup.ps1 parses successfully in PowerShell
• Python compile and diff checks pass

Closes #3.