fix(cloudflare): protect agent panel, workspaces & shell scripts from Rocket Loader; trust proxy headers

app/templates/base.html

@@ -108,9 +108,9 @@
     body.embed-mode .page-editor-wrapper { padding: 8px 16px !important; max-width: 100% !important; }
     body.embed-mode .page-cover-area { padding-top: 0 !important; }
   </style>
-  <script src="/static/js/htmx.min.js"></script>
+  <script src="/static/js/htmx.min.js" data-cfasync="false"></script>
   <script src="/static/js/alpine.min.js" defer data-cfasync="false"></script>
-  <script src="/static/js/sortable.min.js" defer></script>
+  <script src="/static/js/sortable.min.js" defer data-cfasync="false"></script>
 </head>
 <body hx-headers='{"X-CSRF-Token":"__CSRF_PLACEHOLDER__"}'{% if embed_mode %} class="embed-mode"{% endif %}>
 <div class="app-layout" x-data="appState()">
@@ -1942,7 +1942,7 @@
     }
   });
 </script>
-<script src="/static/js/app.js?v=2.4.8" defer></script>
+<script src="/static/js/app.js?v=2.4.8" defer data-cfasync="false"></script>
 
 <style>
 .flowdeck-modal-overlay{position:fixed;top:0;left:0;right:0;bottom:0;background:rgba(0,0,0,0.6);z-index:2000;display:flex;align-items:center;justify-content:center;}