fix(ip): resolve client IP from a trusted proxy hop, not X-Forwarded-For[0]

[dddabtc]

Problem

/api/anon and /api/auth/callback both compute the client IP as:

function clientIp(req) {
  const xff = req.headers.get('x-forwarded-for');
  if (xff) return xff.split(',')[0].trim();   // left-most = most client-controllable
  return req.headers.get('x-real-ip') || '0.0.0.0';
}

X-Forwarded-For is a client-settable header and the left-most entry is the one a caller can forge. The IP is used for per-IP caps:

• the anonymous free-prompt allowance (hashIp is bound into the anon token; rotating the header mints fresh free quota and can drain the daily free-subsidy budget),
• the per-IP account-creation limit (recordNewAccountForIp), an anti-bot control.

So an attacker rotates X-Forwarded-For to bypass both.

Fix

Add a shared lib/client-ip.ts that returns the entry inserted by the outermost trusted proxy — the XFF_TRUSTED_PROXY_COUNT-th from the right (default 1, i.e. a single CDN/load balancer) — rather than the attacker-controllable left-most value. Both routes use it.

Operators set XFF_TRUSTED_PROXY_COUNT to their real proxy hop count. (If the app is exposed with no proxy at all, X-Forwarded-For can't be trusted regardless — a proxy must set it.)