security: parse X-Forwarded-For from trusted proxies for rate-limit key

Resolves plan item A.1 (option б): login/setup rate-limiting used
RemoteAddr only, which behind the default reverse proxy is the proxy's own
address, making the limiter effectively global and enabling a lockout-DoS.
Now, when the request's direct peer matches the new TRUSTED_PROXY_CIDR list
(comma-separated CIDRs, env, empty by default), the last X-Forwarded-For
entry is used instead, giving a real per-client limit. Unset behaviour is
unchanged.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/web/handlers_setup.go

@@ -13,7 +13,7 @@ import (
 // page, also 404.
 func (s *Server) handleSetup(w http.ResponseWriter, r *http.Request) {
 	// Route-specific rate limit, separate from login (spec 7.6.1).
-	if !s.setupLimiter.Allow(clientIP(r)) {
+	if !s.setupLimiter.Allow(clientIP(r, s.trustedProxies)) {
 		http.Error(w, "too many requests", http.StatusTooManyRequests)
 		return
 	}