fix: socket reconnection loop and trust proxy validation error

[robertsLando]

Summary

Fixes two issues affecting users behind reverse proxies (notably the Home Assistant addon).

Socket reconnection loop (Fixes #4564)

When the server's auth middleware rejected a socket connection (e.g. expired JWT), the client silently looped on reconnection forever. Socket.IO v4 emits connect_error on rejected handshakes, but the client only listened for error.

• src/App.vue — JWT expiry is checked client-side before attempting to connect; an expired token triggers logout() instead of a connect attempt.
• src/App.vue — added a connect_error handler. Three consecutive auth failures trigger logout (single failures are tolerated to ride out transient issues); other errors update status to Reconnecting.

ERR_ERL_UNEXPECTED_X_FORWARDED_FOR validation error (Fixes #4535)

express-rate-limit emitted a noisy ValidationError on every restart for users running behind a reverse proxy. The pre-existing TRUST_PROXY env-var path looked correct but was effectively broken: TRUST_PROXY=1 was forwarded to app.set('trust proxy', '1') as a string, which Express treats as the IP literal "1" — leaving trust proxy effectively off and the validation error firing.

• api/app.ts — parseTrustProxy() coerces the raw env value: "true"/"false" → boolean, numeric strings → hop count integer, anything else → passed through verbatim (IP/CIDR list or preset name).
• api/app.ts — moved app.set('trust proxy', ...) into startServer() via configureTrustProxy(), mirroring how HTTPS is handled. Logs the resolved value at startup.
• docs/guide/env-vars.md — expanded the TRUST_PROXY description with accepted formats and a note about ERR_ERL_PERMISSIVE_TRUST_PROXY (don't set it to true; prefer an explicit hop count or IP list).

This pairs with home-assistant/addons#4597, which sets TRUST_PROXY=1 by default in the HA addon — that PR only actually resolves #4535 once this coercion is in place.

An earlier revision of this PR added an X-Forwarded-For auto-detect middleware and a UI toggle for trust proxy; both have been dropped. Auto-detect was spoofable (any client could trip it via a forged XFF header and bypass the login rate-limiter), and the UI field became redundant once the HA addon set the env var by default.

Test plan

• Verify socket connects successfully when running behind HA ingress proxy
• Verify no ERR_ERL_UNEXPECTED_X_FORWARDED_FOR errors in logs when behind proxy with TRUST_PROXY=1
• Verify expired JWT token triggers logout instead of reconnect loop
• Verify TRUST_PROXY=1 is applied as a hop count (integer), not as the IP literal "1"
• Verify TRUST_PROXY accepting an IP/CIDR list still works
• Verify direct connections (no proxy) are unaffected
• npm run lint passes

[coveralls]

Coverage Report for CI Build 25097969982

Coverage decreased (-0.02%) to 18.285%

Details

• Coverage decreased (-0.02%) from the base build.
• Patch coverage: 27 uncovered changes across 1 file (0 of 27 lines covered, 0.0%).
• No coverage regressions found.

Uncovered Changes

File	Changed	Covered	%
api/app.ts	27	0	0.0%

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	23558
Covered Lines:	4054
Line Coverage:	17.21%
Relevant Branches:	445
Covered Branches:	335
Branch Coverage:	75.28%
Branches in Coverage %:	Yes
Coverage Strength:	1.09 hits per line

---

💛 - Coveralls

[DenverOps]

Has this made it into the release yet?

[robertsLando]

@DenverOps Nope, I have to do some tests before merging but didn't have time yet

[DenverOps]

Thank you sir. No pressure was just trying to understand if I should test on my end on this next release and I didn't see it in the release notes si figured I'd ask.