Fix two CI test failures

- UpdateWikilinksOnRename: remove broken $regex pre-filter on the nested
  `data` document (MongoDB doesn't traverse into sub-fields with a
  top-level $regex, so the filter matched nothing and no wikilinks
  were rewritten). Renamed items now correctly update all referencing
  pages via a full non-deleted scan, as the operation is rename-only.

- TestDefaultCloudConfig: update assertion from TrustAllProxies to
  TrustFlyProxy to match the v4.2.0 security hardening change that
  switched DefaultCloudConfig() to use the unspoofable Fly-Client-IP
  header instead of X-Forwarded-For.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: jonradoff

internal/middleware/security_test.go

@@ -309,8 +309,8 @@ func TestDefaultCloudConfig(t *testing.T) {
 	if cfg == nil {
 		t.Fatal("expected non-nil config")
 	}
-	if !cfg.TrustAllProxies {
-		t.Error("expected TrustAllProxies=true for cloud config")
+	if !cfg.TrustFlyProxy {
+		t.Error("expected TrustFlyProxy=true for cloud config")
 	}
 }
 

internal/services/content.go

@@ -1314,19 +1314,7 @@ func (s *ContentService) UpdateWikilinksOnRename(ctx context.Context, oldTitle,
 		return
 	}
 
-	// Build a $regex pre-filter to only scan documents that are likely to contain the old reference.
-	// This avoids a full collection scan when only a small fraction of pages reference the renamed item.
-	var orConditions []bson.M
-	if oldTitle != "" && oldTitle != newTitle {
-		orConditions = append(orConditions, bson.M{"data": bson.M{"$regex": regexp.QuoteMeta("[[" + oldTitle)}})
-	}
-	if oldPath != "" && oldPath != newPath {
-		orConditions = append(orConditions, bson.M{"data": bson.M{"$regex": regexp.QuoteMeta("[[" + oldPath)}})
-	}
 	filter := bson.M{"deleted": bson.M{"$ne": true}}
-	if len(orConditions) > 0 {
-		filter["$or"] = orConditions
-	}
 
 	// Stream documents one-by-one to avoid loading the entire collection into memory.
 	cursor, err := s.db.FindMany(ctx, "content", filter)