fix(security): fall back to x-real-ip when TRUST_PROXY_COUNT is unset

[ety001]

Summary

Fixes audit V2 finding #3 (High): when TRUST_PROXY_COUNT is not configured, getClientIP() returned 'unknown' for every request, collapsing all clients into a single rate-limit bucket. One abuser could exhaust the shared quota and DoS the endpoint for all legitimate users. The comment claimed it fell back to "socket peer" but Next.js route handlers do not expose a synchronous socket peer.

Changes

src/lib/middleware/rate-limit.ts — new three-tier IP resolution in getClientIP():

1. TRUST_PROXY_COUNT set: Nth-from-right XFF entry (most spoof-resistant) — unchanged.
2. TRUST_PROXY_COUNT unset: fall back to x-real-ip. The reverse proxy (OpenResty/ELB) sets this by overwriting client-supplied values, so it is far harder to spoof than the append-only X-Forwarded-For. This prevents bucket collapse when an operator forgets TRUST_PROXY_COUNT, as long as the reverse proxy sets x-real-ip (standard practice).
3. Neither present: 'unknown' + a one-time production warning log (so operators notice).

tests/unit/rate-limit-proxy.test.ts:

• New test: x-real-ip fallback gives different IPs separate buckets.
• Split the old "unknown" test into with/without x-real-ip cases.

Test plan

• pnpm type-check — clean
• pnpm test — 471 passed