Count per-address limits on the hop a trusted proxy added; limit signup

The limits read the leftmost X-Forwarded-For entry, which the client writes,
and the LAN nginx appended to it. The address now comes from uvicorn's
proxy-headers middleware (rightmost hop not in FORWARDED_ALLOW_IPS), applied
in the app too so tunnel-replayed calls resolve the same way; nginx sets the
header to $remote_addr and the compose backend trusts the Docker networks.
/users/signup gets a per-address limit of 10 an hour.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ

docker/nginx-api-proxy.conf

@@ -13,7 +13,10 @@ location /api {
 
     proxy_http_version 1.1;
     proxy_set_header Host $host;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    # Replaced, not appended to: whatever the client sent would otherwise sit
+    # in front of the one hop the backend believes, and anything reading the
+    # header naively would take it for the caller.
+    proxy_set_header X-Forwarded-For $remote_addr;
     proxy_set_header X-Forwarded-Proto $scheme;
     # The flow websocket (/api/v1/flows/ws) upgrades through here; passing the
     # client's own Connection header covers both it and ordinary requests.