fix(deploy): trust x-forwarded-for for per-IP rate limiting

fix(app): 503 on storage failures, validated currency, lock release on shutdown, per-IP login limit, unit-only npm test

chore: add Dockerfile and Space README

initial commit