feat: add trusted client-IP extraction from proxy headers

Add get_client_ip() helper that inspects Forwarded and X-Forwarded-For
headers only when the direct peer is in TRUSTED_PROXIES (comma-separated
IPs/CIDRs). Replaces raw request.client.host in rate-limit and webhook
source_ip to prevent all traffic collapsing behind a reverse proxy IP.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/app/core/config.py

@@ -65,6 +65,11 @@ class Settings(BaseSettings):
     rate_limit_backend: RateLimitBackend = RateLimitBackend.MEMORY
     rate_limit_redis_url: str = ""
 
+    # Trusted reverse-proxy IPs/CIDRs for client-IP extraction from
+    # Forwarded / X-Forwarded-For headers.  Comma-separated.
+    # Leave empty to always use the direct peer address.
+    trusted_proxies: str = ""
+
     # Database lifecycle
     db_auto_migrate: bool = False