feat : 6 astra improve it

.env.example

@@ -4,10 +4,6 @@ BASE_URL=https://guide.sudloh.com
 # Public AdSense publisher client ID. Leave unset to disable ads locally.
 NEXT_PUBLIC_GOOGLE_ADSENSE_CLIENT_ID=ca-pub-9687404323559597
 
-# Local-only demo mode serves sanitized fixtures and bypasses external services.
-# Keep this false in every deployed environment.
-BUZZ_DEMO_MODE=false
-
 # PostgreSQL
 DATABASE_URL=postgresql://buzz_sheet:[email protected]:5432/buzz_sheet?sslmode=require
 DATABASE_POOL_SIZE=10
@@ -27,6 +23,7 @@ REDIS_URL=rediss://default:[email protected]:6379
 REDIS_CACHE_PREFIX=buzz:next-cache
 REDIS_EVENT_PREFIX=buzz:events
 REDIS_PRESENCE_PREFIX=buzz:presence
+REDIS_SECURITY_PREFIX=buzz:security
 REDIS_CACHE_MAX_ENTRY_BYTES=5242880
 OUTBOX_BATCH_SIZE=20
 OUTBOX_POLL_MS=1000
@@ -38,7 +35,7 @@ DISCORD_BOT_TOKEN=replace-with-discord-bot-token
 DISCORD_CHANNEL_ID=replace-with-private-channel-id
 DISCORD_LOG_CHANNEL_ID=1547193755772125184
 
-# S3-compatible private media storage
+# S3-compatible media storage; direct guide uploads use public CDN objects.
 S3_ENDPOINT=https://s3.example.internal
 S3_PUBLIC_URL=https://buzz-cdn.astrxl.dev
 S3_REGION=auto
@@ -55,3 +52,6 @@ NEXT_DEPLOYMENT_ID=local-development
 
 # Readiness dependency timeout.
 HEALTHCHECK_TIMEOUT_MS=2500
+
+# Set only when Traefik overwrites this header and direct pod ingress is denied.
+TRUSTED_CLIENT_IP_HEADER=