fix(cloudflare): protect agent panel, workspaces & shell scripts from Rocket Loader; trust proxy headers

Dockerfile

@@ -41,4 +41,4 @@ EXPOSE 8080
 HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
   CMD curl -f http://localhost:8080/api/health || exit 1
 
-CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8080"]
+CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8080", "--proxy-headers", "--forwarded-allow-ips", "*"]

app/templates/_header.html

@@ -142,7 +142,7 @@
   </div>
 </header>
 
-<script>
+<script data-cfasync="false">
 document.addEventListener('alpine:init', function () {
   if (window.Alpine && window.Alpine.__fdBreadcrumbRegistered) return;
   if (window.Alpine) window.Alpine.__fdBreadcrumbRegistered = true;

app/templates/_page_editor_realtime.html

@@ -9,7 +9,7 @@
 .rt-cursor .rt-cursor-name{position:absolute;top:-14px;left:4px;white-space:nowrap;font-size:9px;line-height:12px;padding:0 4px;border-radius:4px;color:#fff;font-weight:600;letter-spacing:.2px;}
 .rt-offline{font-size:11px;color:var(--text-tertiary,#999);margin-right:6px;display:none;}
 </style>
-<script>
+<script data-cfasync="false">
 /* eslint-disable */
 /* ═══════════ v5.13.0 Realtime — WS gateway, présence, curseurs, merge LWW ═══════════ */
 window.__fdRT = (function () {

app/templates/agent_panel.html

@@ -204,7 +204,7 @@
 </style>
 
 {# ── Global Agent API (available before Alpine for the FAB / shortcut) ── #}
-<script>
+<script data-cfasync="false">
 (function(){
   var defaultAPI = {
     open: function(){ document.dispatchEvent(new CustomEvent('fd-agent-toggle')); },
@@ -456,7 +456,7 @@
   </div>
 </div>
 
-<script>
+<script data-cfasync="false">
 (function(){
   // ── Skills intégrés (workflows « / ») et commandes admin du panneau ──
   var FD_ADMIN_CMDS = [

app/templates/base.html

@@ -108,9 +108,9 @@
     body.embed-mode .page-editor-wrapper { padding: 8px 16px !important; max-width: 100% !important; }
     body.embed-mode .page-cover-area { padding-top: 0 !important; }
   </style>
-  <script src="/static/js/htmx.min.js"></script>
+  <script src="/static/js/htmx.min.js" data-cfasync="false"></script>
   <script src="/static/js/alpine.min.js" defer data-cfasync="false"></script>
-  <script src="/static/js/sortable.min.js" defer></script>
+  <script src="/static/js/sortable.min.js" defer data-cfasync="false"></script>
 </head>
 <body hx-headers='{"X-CSRF-Token":"__CSRF_PLACEHOLDER__"}'{% if embed_mode %} class="embed-mode"{% endif %}>
 <div class="app-layout" x-data="appState()">
@@ -1942,7 +1942,7 @@
     }
   });
 </script>
-<script src="/static/js/app.js?v=2.4.8" defer></script>
+<script src="/static/js/app.js?v=2.4.8" defer data-cfasync="false"></script>
 
 <style>
 .flowdeck-modal-overlay{position:fixed;top:0;left:0;right:0;bottom:0;background:rgba(0,0,0,0.6);z-index:2000;display:flex;align-items:center;justify-content:center;}

app/templates/workspaces.html

@@ -172,7 +172,7 @@
 
 </div>
 
-<script>
+<script data-cfasync="false">
 function workspacesPage() {
   return {
     workspaces: [],