The generated api.conf and services.conf we edited earlier were overwritten at container startup by envsubst from *.template files. Fix the actual templates: - api.conf.template: X-Forwarded-For → $remote_addr, add limit_req - services.conf.template: add frame-ancestors CSP after proxy_hide_header - Add Prisma migration file for ticket_tiers.reserved_count Bunker Admin