fix(app): stop trusting X-Forwarded-For, and pin what the audit found

ProxyFix defaults x_for to 1, so ProxyFix(app.wsgi_app, x_proto=1) never
disabled it: request.remote_addr and the access log were forgeable by any
client that reached the app directly. It is x_for=0 now, asserted rather
than assumed.

A mutation audit over the change set reverted 196 deliberate behaviours
and found 47 that no test noticed. This closes the ones that carry damage:

- apod_background lost its key check, its transport guard, its status
  guard and its media-type check without a single test failing. Each one
  turns a slow or unhappy NASA into a 500 on every page.
- Untrusted values reached innerHTML through window.I18N, which the
  translation backend writes, and the modal's click handlers stacked so a
  later click opened an earlier popup's URL.
- The sync tool could ask for HTML instead of text, translate from "auto"
  instead of English, run without a timeout, store an empty translation
  that marks the string done for good, abandon 28 languages because one
  could not be written, and report success after reaching nothing.
- Neither the lint target, the CI jobs, the vendored RTL stylesheet, the
  documented environment keys, nor any of the four hardenings in
  scripts/run-e2e.sh was observed by anything.

Three of the new tests passed for the wrong reason on their first cut —
a mock that answered None whether or not the guard existed, a
raise_for_status that was never called, a string that stayed in the file
after the mutation. The audit found those too; all 24 reverts now fail.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/lint/test_tooling_configuration.py

@@ -5,6 +5,7 @@ checks: the deletion is invisible to every suite, and its effect only shows up
 in production or in a fresh checkout.
 """
 
+import json
 import re
 import tomllib
 import unittest
@@ -64,6 +65,84 @@ class TestRunTargets(unittest.TestCase):
                 self.assertNotIn("--env-file", body)
 
 
+class TestLintCoverage(unittest.TestCase):
+    def setUp(self):
+        self.makefile = (REPO_ROOT / "Makefile").read_text(encoding="utf-8")
+
+    def test_the_lint_target_runs_every_linter(self):
+        prerequisites = re.search(r"^lint: (.+)$", self.makefile, re.MULTILINE).group(1)
+
+        self.assertGreaterEqual(
+            set(prerequisites.split()),
+            {"lint-actions", "lint-python", "lint-yaml", "lint-js", "lint-shell"},
+        )
+
+    def test_every_linter_has_a_ci_job(self):
+        workflow = yaml.safe_load(
+            (REPO_ROOT / ".github" / "workflows" / "lint.yml").read_text(
+                encoding="utf-8"
+            )
+        )
+
+        self.assertGreaterEqual(
+            set(workflow["jobs"]),
+            {"lint-actions", "lint-python", "lint-yaml", "lint-js", "lint-shell"},
+        )
+
+    def test_the_javascript_linter_is_declared(self):
+        package = json.loads(
+            (REPO_ROOT / "app" / "package.json").read_text(encoding="utf-8")
+        )
+
+        self.assertGreaterEqual(
+            set(package["devDependencies"]), {"eslint", "@eslint/js", "globals"}
+        )
+
+    def test_the_documented_environment_keys_exist(self):
+        example = (REPO_ROOT / "env.example").read_text(encoding="utf-8")
+
+        for key in ("PORT", "IMAGE_NAME", "TRUSTED_HOSTS", "LIBRETRANSLATE_URL"):
+            with self.subTest(key=key):
+                self.assertRegex(example, rf"(?m)^{key}=")
+
+
+class TestEndToEndRunner(unittest.TestCase):
+    def setUp(self):
+        self.script = (REPO_ROOT / "scripts" / "run-e2e.sh").read_text(encoding="utf-8")
+
+    def test_a_foreign_listener_stops_the_run(self):
+        self.assertIn("already serves port", self.script)
+
+    def test_cypress_is_pinned_to_the_origin_flask_binds(self):
+        self.assertIn("CYPRESS_baseUrl", self.script)
+        self.assertIn("127.0.0.1", self.script)
+
+    def test_the_electron_node_flag_is_dropped(self):
+        self.assertIn("env -u ELECTRON_RUN_AS_NODE", self.script)
+
+    def test_every_probe_bypasses_a_proxy_and_is_bounded(self):
+        probes = [line for line in self.script.splitlines() if "curl " in line]
+
+        self.assertTrue(probes)
+        for probe in probes:
+            with self.subTest(probe=probe.strip()):
+                self.assertIn("--noproxy", probe)
+                self.assertIn("--max-time", probe)
+
+
+class TestVendoredAssets(unittest.TestCase):
+    def test_the_right_to_left_stylesheet_is_vendored(self):
+        script = (REPO_ROOT / "app" / "scripts" / "copy-vendor.js").read_text(
+            encoding="utf-8"
+        )
+
+        self.assertEqual(
+            script.count("bootstrap.rtl.min.css"),
+            2,
+            "the RTL stylesheet needs both a source and a destination path",
+        )
+
+
 class TestPackagedCatalogs(unittest.TestCase):
     def test_the_interface_catalogs_are_declared_as_package_data(self):
         with (REPO_ROOT / "pyproject.toml").open("rb") as handle: