feat(source2): push all latest files - device labeling, help system, proxy docs, database isolation fix

- Added DOKUMENTASI-FILTER-PER-SITE.md (site isolation docs)
- Fixed start-with-env.js to force-load .env.production
- Fixed MONGODB_URI hostname from mongodb-netify to mongodb.prod.proit.id
- Updated .gitignore to exclude sensitive scripts and credential files
- Minor UI and labeling improvements

proxy/index.js

@@ -1,10 +1,16 @@
 // proxy/index.js
 // ─────────────────────────────────────────────────────────────────────────────
+// Polyfill global crypto for Node 18 compatibility (required by mongodb driver)
+if (typeof globalThis.crypto === 'undefined') {
+  globalThis.crypto = require('crypto');
+}
+
 // BackOne Proxy Server - Entry Point
 // ─────────────────────────────────────────────────────────────────────────────
 
 const path = require('path');
-require('dotenv').config({ path: path.join(__dirname, '..', '.env.local') });
+const envFile = process.env.NODE_ENV === 'production' ? '.env.production' : '.env.local';
+require('dotenv').config({ path: path.join(__dirname, '..', envFile) });
 
 const express   = require('express');
 const cors      = require('cors');
@@ -57,11 +63,13 @@ async function main() {
   console.log('╚════════════════════════════════════════════════╝\n');
   console.log(`[Proxy] Mode: ${process.env.PROXY_COLLECT_MODE || 'all'}`);
   
-  // Start REST API server first so liveness probes remain active
-  app.listen(PORT, '0.0.0.0', () => {
-    console.log(`\n🚀 Proxy REST API running at http://0.0.0.0:${PORT}`);
+  // Bind to 127.0.0.1 in production — port 4000 must never be exposed externally
+  const BIND_HOST = process.env.NODE_ENV === 'production' ? '127.0.0.1' : '0.0.0.0';
+  app.listen(PORT, BIND_HOST, () => {
+    console.log(`\n🚀 Proxy REST API running at http://${BIND_HOST}:${PORT}`);
     console.log(`   GET  /health   → liveness check`);
-    console.log(`   GET  /status   → scheduler + DB status\n`);
+    console.log(`   GET  /status   → scheduler + DB status`);
+    console.log(`🔒 Security   : Bound to ${BIND_HOST} (internal only in production)\n`);
   });
 
   const connected = await connectDB();