v2.2.1

Fixes for running behind Cloudflare: a health check that is never cached,
a deploy smoke test that understands Cloudflare schema validation, and a rate
limit that leaves the server's own requests alone, so its burst can be small.
GraphQL errors now come in a stable order. The /v1 and GraphQL contracts are
unchanged.

Changed

• The rate limit no longer counts requests from the server itself: over
  loopback and not forwarded by a proxy, such as health checks and the deploy's
  smoke test. A smaller RATE_LIMIT_BURST no longer fails the smoke test of a
  deploy. A forwarded X-Forwarded-For: 127.0.0.1 still counts.

Fixed

• /healthz answers with Cache-Control: no-store. Behind Cloudflare it got
  the default edge Cache-Control of CACHE_MODE, so with a cache rule a
  health check could read a cached "ok".
• The deploy's smoke test through the public address accepts Cloudflare's
  firewall block (403, error 1020) for its invalid requests as well as the
  API's 422 (smoke_matrix.py --edge-blocks-invalid). Cloudflare schema
  validation rejected them at the edge, and that rolled back a healthy
  release. Any other 403 still fails the test.
• GraphQL errors are listed in the order their fields appear in the query.
  Before, they came in the order the resolvers finished, so one query could
  return them in a different order each time.