fix: harden configs and restrict GraphQL user queries

[cfchase]

Summary

• Restrict --forwarded-allow-ips to 127.0.0.1 in Dockerfile
• Require admin role for GraphQL users and user(id) queries
• Remove credential echo from deploy.sh stdout
• Bind MinIO S3 API port to localhost only in dev-langfuse.sh
• Return generic error message in health check endpoint
• Support sse MCP server type in import_flows.py
• Add SSE heartbeat keepalive to prevent chunked connection drops through proxy layers
• Set nginx, OAuth proxy, and OpenShift Route timeouts to 300s for long-running SSE streams
• Fix LangFlow XDG_STATE_HOME to writable path (/tmp/langflow)

Test plan

• Backend tests pass (223/223)
• UAT: non-admin user blocked from { users } GraphQL query
• UAT: admin user can still query { users }
• UAT: { me } query unaffected for all users
• UAT: make import succeeds with SSE-type MCP server
• Verified Dockerfile, deploy.sh, dev-langfuse.sh changes by inspection
• UAT: enterprise agent query streams successfully through all proxy layers (no network error)
• UAT: SSE heartbeats keep connection alive during LangFlow processing (~5-10 min)

🤖 Generated with Claude Code