feat(09-05): roll the canonical arena to botfights:1.2.0

- docker-compose.arena.yml: image tag 1.1.0 -> 1.2.0, refreshed the
  TRUSTED_PROXY comment to reflect the live NPM+TLS front-end (no
  longer "no DNS/TLS this phase" — that shipped mid-phase).
- Deployed on VPS2: docker compose pull + up -d, container recreated,
  healthy, data volume untouched.
- Verified end-to-end through the public HTTPS URL: health, unified
  prompt (ARENA_URL substituted, zero leftover template tokens), a
  freshly registered test bot visible in GET /api/bots, bot auth via
  the now-fixed GET /api/fights/poll, and data integrity (100 + 15
  classic bots, unchanged from before the roll).
- docs/arena-deployment.md: recorded the second (post-poll-fix) image
  digest and the fix.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docker-compose.arena.yml

@@ -18,7 +18,7 @@
 
 services:
   botfights-arena:
-    image: localhost:3000/lfg2025/botfights:1.1.0
+    image: localhost:3000/lfg2025/botfights:1.2.0
     container_name: botfights-arena
     restart: unless-stopped
     ports:
@@ -26,8 +26,8 @@ services:
     volumes:
       - botfights-arena-data:/app/server/data
     # Explicit override (not just relying on the image's baked-in HEALTHCHECK):
-    # the currently published 1.1.0 tag predates the Dockerfile's HEALTHCHECK
-    # directive, so `docker ps` shows no health status without this.
+    # the currently published 1.1.0 tag predated the Dockerfile's HEALTHCHECK
+    # directive; kept for continuity across image rolls.
     healthcheck:
       test: ["CMD", "node", "-e", "fetch('http://localhost:9100/api/health').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
       interval: 30s
@@ -39,15 +39,15 @@ services:
       - PORT=9100
       - FIGHT_LOOP_ENABLED=true
       - PUBLIC_ARENA_URL=https://botfights.archipelago-foundation.org
+      # TRUSTED_PROXY=1 since 2026-07-30: the arena now sits behind
+      # nginx-proxy-manager at https://botfights.archipelago-foundation.org
+      # (Let's Encrypt cert, live). The app trusts X-Forwarded-For from NPM
+      # for its per-IP rate limiting instead of the raw socket peer (which
+      # would otherwise see every request as coming from NPM's own IP).
       - TRUSTED_PROXY=1
       # Auth — value comes from the host .env, never hardcoded here.
       # Generated on VPS2 with: openssl rand -hex 32 (see docs/arena-deployment.md)
       - JWT_SECRET=${JWT_SECRET}
-      # Deliberately OMITTED: TRUSTED_PROXY
-      # No NPM/reverse-proxy sits in front of this instance (plain HTTP on the
-      # raw port, user decision 2026-07-30 — no DNS/TLS this phase). Clients hit
-      # :9100 directly, so the app's rate-limit middleware must key off the real
-      # TCP socket peer IP, not a forwarded header a direct caller could forge.
       - BOTFIGHTS_CREATOR_PUBKEYS=${BOTFIGHTS_CREATOR_PUBKEYS:-da5e0c1b646bdb13c2300f805b0ca3e5afe5b052c594ce78bac8978d21c3fa39}
       # Deliberately OMITTED: this instance IS the upstream — never point it at
       # another arena.