security: validate trusted proxy before trusting IP headers

[cfsmp3]

Summary

• Only trust X-Real-IP and X-Forwarded-For headers when request is from a trusted proxy
• Prevent rate limit bypass via spoofed IP headers

Security Issue Addressed

Rate Limiter IP Spoofing (Medium) - Previously, the rate limiter trusted X-Real-IP and X-Forwarded-For headers from any source. An attacker could bypass rate limiting by sending fake headers with different IP addresses.

Changes

• backend/middleware/ratelimit.go:
  • Add isTrustedProxy() function to validate proxy source
  • Trust loopback addresses (nginx on same server)
  • Support TRUSTED_PROXIES env var for additional trusted IPs (comma-separated, CIDR supported)
  • Trust Docker bridge network (172.16.0.0/12) in production
  • For untrusted connections, use RemoteAddr directly

Configuration

To configure additional trusted proxies, set the TRUSTED_PROXIES environment variable:

# Single IP
TRUSTED_PROXIES="10.0.0.1"

# Multiple IPs
TRUSTED_PROXIES="10.0.0.1,10.0.0.2"

# CIDR notation
TRUSTED_PROXIES="10.0.0.0/8,192.168.0.0/16"

Test plan

• Verify rate limiting works correctly behind nginx (X-Real-IP trusted)
• Verify direct connections use RemoteAddr
• Verify spoofed headers are ignored for direct connections

🤖 Generated with Claude Code

[github-actions]

Thank you for opening this PR!

Before a maintainer takes a look, it would be really helpful if you could walk through your changes using GitHub's review tools.

Please take a moment to:

• Check the "Files changed" tab
• Leave comments on any lines for functions, comments, etc. that are important, non-obvious, or may need attention
• Clarify decisions you made or areas you might be unsure about and/or any future updates being considered.
• Finally, submit all the comments!

More information on how to conduct a self review:
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request

This helps make the review process smoother and gives us a clearer understanding of your thought process.

Once you've added your self-review, we'll continue from our side. Thank you!