Keep MySQL internal-only with env-based credentials, proxy /api/backend through nginx with Docker DNS refresh, and support host SOCKS/HTTP proxy during image builds. Co-authored-by: Cursor <cursoragent@cursor.com>