Closing the Loop: Proxy-Aware Rate Limiting With X-Forwarded-For

TL;DR The previous PR fixed getLocalAddr() → getRemoteAddr() for rate limiting. That fix is still broken behind a reverse proxy: getRemoteAddr() returns the proxy's IP, so all real clients share one