fix(server): k8s rollout readiness

- TRUSTED_HOSTS env: configurable trusted hostnames for proxy-domain access (default stays strict: localhost/loopback/private IP); k8s manifest sets tg.workstation.internal (L-8 follow-up)
- Media allowlist +10: mkv/mk3d/heic/tgs/flv/3gp/ogv/asf/wmv/djvu (live disk has .tgs x44, .mkv x2)
- Cache buster: app.js?v=4 -> ?v=5 so browsers pick up the new bundle
- +6 tests (64 passing); REVIEW.md updated with live-cluster rollout notes

k8s/telegram-scraper.yaml

@@ -41,6 +41,9 @@ spec:
           image: gcr.forust.xyz/forust/telegram-scraper:latest
           stdin: true
           tty: true
+          env:
+            - name: TRUSTED_HOSTS
+              value: "tg.workstation.internal"
           ports:
             - containerPort: 8080
           resources: