security: parse X-Forwarded-For from trusted proxies for rate-limit key

Resolves plan item A.1 (option б): login/setup rate-limiting used
RemoteAddr only, which behind the default reverse proxy is the proxy's own
address, making the limiter effectively global and enabling a lockout-DoS.
Now, when the request's direct peer matches the new TRUSTED_PROXY_CIDR list
(comma-separated CIDRs, env, empty by default), the last X-Forwarded-For
entry is used instead, giving a real per-client limit. Unset behaviour is
unchanged.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

deploy/.env.example

@@ -15,3 +15,11 @@ RATE_LIMIT_WINDOW_SECONDS=3600
 
 # Days of send-log history kept before the background sweep deletes rows.
 SEND_LOG_RETENTION_DAYS=90
+
+# Comma-separated CIDRs (bare IPs allowed) of reverse proxies allowed to
+# supply X-Forwarded-For for login/setup rate-limiting. Leave unset unless
+# you know the exact address of your reverse proxy — trusting the wrong
+# source lets a client spoof its rate-limit key. Behind the default Apache
+# host-network setup this is typically the Docker bridge gateway, e.g.
+# TRUSTED_PROXY_CIDR=172.18.0.1
+