fix: allow HTTPS images in CSP for map tiles

fix: use Express 5 catch-all route syntax

remove: incorrectly placed root app.js

fix: set trust proxy for express-rate-limit behind HF proxy