stop printing the content browser's title twice

ویو `title` را به کانتکست می‌دهد و admin/base.html خودش آن را هم در مسیرِ
راهنما و هم به‌عنوان <h1> صفحه رندر می‌کند. قالب یک <h1> دستی هم داشت، پس
عنوان دو بار پشتِ هم چاپ می‌شد. دستی برداشته شد؛ عنوانِ تبِ مرورگر و مسیرِ
راهنما دست‌نخورده می‌مانند چون هر دو از همان `title` می‌آیند.

بخشِ وضعیت در CLAUDE.md هم به‌روز شد: می‌گفت سرور کدِ قدیمی و دیتابیسِ خالی
دارد، که دیگر درست نیست. به‌جایش چیزی نوشته شد که دفعه‌ی بعد به درد بخورد —
اینکه فایلِ روی دیسک یعنی فایلِ مستقر‌شده نیست، و چه چیزهایی عمداً باز مانده.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CLAUDE.md

@@ -275,22 +275,42 @@ preferred setup, because there is then no key to leak. **Never let the server ru
 `django-insecure-…` fallback from `config/settings.py`: that string is committed here, so
 anyone who can read this repo can forge a token for any user.**
 
-## State as of 2026-09-17 — read this first
+## State as of 2026-09-17 (evening) — read this first
 
-**Backend is done and verified; nothing is blocked on us.** The full game loop was driven
-end to end against a fresh database with `DEBUG=0`: grades → login → set grade → home →
-node quiz → submit answer → CORS header for the frontend origin. `main` is pushed and
-clean at `16d3d9f`; 435 tests green.
+**The server is live and running current code.** `main` is at the latest commit, the
+service `gunicorn-mathapp` was restarted against it, and `/api/health` reports
+`grades: 6, lessons: 1928, questions: 1441`. `/api/nodes/1/quiz` returns a real
+four-question quiz. 435 tests green.
 
-Two things are blocked on other people, and both are worth checking before assuming a bug:
+What that took, and the lessons worth keeping:
 
-1. **The server still runs pre-16d3d9f code with an empty database.** `git pull &&
-   ./deploy.sh` brings both code and content. Verify with `curl /api/health` — it should
-   report `questions: 1441`. A 404 there means the pull never landed.
-2. **The frontend is not wired to any API.** `src/api/` was merged (PR #1) but is
-   imported nowhere; `QuestionScreen` in `App.tsx` still renders four hardcoded
-   multiplication questions. **PR #3** (`zareian/api-client-2`, 3 commits) is still open on
-   upstream. Until someone connects the screens, none of the 1,441 questions are visible.
+1. **The server ran two-day-old code while every file on disk was current.** The pull and
+   `seed_content` had happened; the service had simply never been restarted, so gunicorn
+   still served the code it loaded on Sep 15. WhiteNoise builds its static-file index at
+   startup too, which is why `collectstatic` had run and the admin panel still had no CSS.
+   **A file on disk is not a deployed file.** Check
+   `systemctl show <service> -p ActiveEnterTimestamp` before believing anything.
+2. **`deploy.sh` reported success while this was true.** It health-checked a public URL
+   that the *old* process answered with 200. It now compares the service start time
+   before and after, and exits non-zero when the restart did not happen.
+3. **Two files had been hand-edited on the server** (`config/urls.py`, `deploy.sh`), both
+   only to add a trailing slash to the health route. That is why `git pull` kept
+   conflicting. `api/health/` is now registered upstream alongside `api/health`, so the
+   edits were reverted and are not needed again.
+
+Still open, and deliberately not acted on:
+
+- **`DJANGO_SECRET_KEY` on the server is the `django-insecure-…` fallback committed in
+  `config/settings.py`.** Auth tokens are signed with it, so anyone who can read this repo
+  can forge one. Fixing it means removing the key from `.env` *and* from the systemd unit
+  and letting settings generate one. The owner decided this is the server admin's call,
+  not ours. `manage.py check --deploy` flags it as `security.W009` on every release.
+- `CACHE_URL` is unset, so rate limiting is per-worker (`LocMemCache`). Redis is already
+  running on the box at `127.0.0.1:6379`; `db0` belongs to another app, `db1` is free.
+- The frontend is still not wired to any API. `src/api/` was merged (PR #1) but is
+  imported nowhere; `QuestionScreen` in `App.tsx` still renders four hardcoded
+  multiplication questions, and **PR #3** (`zareian/api-client-2`) is still open upstream.
+  Until someone connects the screens, none of the 1,441 questions are visible to a user.
 
 The frontend's `Question` type carries a `type` field that nothing reads, and
 `count_objects` in `Question.TYPE_CHOICES` is an empty shell — no rows, no serializer