Define self-host trust and transport contract

[vekexasia]

Question

What reverse-proxy, forwarded-header, direct-backend-access, TLS, secret, migration, and build-time configuration guarantees must self-hosted deployments enforce and document?