Harden and polish buffer.lol

[1337lean]

What changed

• hardens outbound diagnostics against DNS rebinding and oversized/chunked request bodies
• makes proxy trust explicit, bounds in-memory caches, expands reserved-IP filtering, and requires worker authentication in production
• filters internal traceroute hops and adds security headers
• aligns latency/stability/IP lookup naming and homepage copy with actual behavior
• adds structured diagnostic results, copy actions, accessibility improvements, and a branded 404
• replaces broken root SEO files with generated robots and sitemap routes plus canonical metadata
• completes the HTTPS-only BufferDash loader and privacy documentation
• adds tests and CI validation before VPS deployment
• switches the app image to a smaller standalone, non-root runtime
• updates Next.js to 16.2.10

Why

The live review found that robots.txt and sitemap.xml returned 404, several labels implied ICMP behavior that the browser tools do not perform, successful backend output was mostly raw JSON, and important server boundaries needed tighter enforcement. The previous Docker image also copied the full build tree and ran as root.

Impact

The UI remains intentionally small, but tool descriptions and results are clearer. Production deployments now fail closed when the diagnostics worker token is missing. Proxy-derived client IPs are trusted only when explicitly configured.

Before deployment, confirm the VPS sets:

• TRUST_PROXY_HEADERS=true behind Caddy
• a non-empty DIAGNOSTICS_WORKER_TOKEN

Validation

• clean npm ci
• ESLint
• TypeScript
• 15/15 Vitest tests
• production Next.js build
• dependency audit with zero vulnerabilities
• desktop and mobile browser QA
• live-like DNS, HTTP, redirect, robots, sitemap, and 404 smoke tests
• standalone Docker build and non-root container smoke test