[ajasnosz]

Summary

The frontend image ran yarn run start:demo, which is webpack-dev-server in development mode, compiled at every pod start. That made it impractical to put behind a TLS reverse proxy: the dev server rejected the proxy's hostname,
api.js hard-coded http://, and the browser had to reach the backend NodePort directly. Customers worked around it with scripts that patch the running pods.

This PR replaces the dev server with a production build served by an unprivileged nginx, and makes API calls same-origin.

Changes

• Frontend image (frontend/Dockerfile, frontend/nginx/*): a two-stage build with the build stage on $BUILDPLATFORM and a final nginx-unprivileged image.
  • It serves the static build, forwards /api/ to BACKEND_URL, and sets security headers.
  • It listens on DEMO_PORT and runs as an arbitrary UID with a read-only root filesystem (writes only to /tmp).
  • entrypoint.sh validates its env values before rendering the config. TRUSTED_PROXY_CIDRS makes nginx take the real client address from X-Forwarded-For for listed proxies.
• API client (api.js, host.jsx removed): baseURL is /api. start:demo proxies /api to the Flask backend for local development.
• Bundle (webpack.standalone.config.js): no eval source maps in production builds, so the CSP needs no unsafe-eval. The bundle drops from about 10 MB to 1.8 MB.
• Backend (__init__.py): new TRUSTED_PROXY_COUNT (default 0) enables werkzeug ProxyFix. Behind a proxy, the /auth/login rate limit (5 per minute) is then per client rather than shared by everyone.
• Tests: test_trusted_proxy.py for the backend and api.test.js for the frontend.

Compatibility

• The image works with the existing chart: same DEMO_PORT, securityContext and Service name ui-backend-entrypoint.
• It breaks setups that patch the frontend container (a custom command, edits to files in the pod, REACT_APP_FLASK_PORT). Those patches must be removed.
• Chart-side changes (serviceType, trustedProxyCIDRs, ClusterIP backend default) are in a separate PR in splunk-connect-for-snmp.