fix: prevent localhost auth bypass via X-Forwarded-For spoofing

[marcusquinn]

Summary

Fixes #19 — Security: Localhost auth bypass via X-Forwarded-For spoofing

• Add TRUST_PROXY config flag (default false). When false, the server uses Bun's native requestIP() to read the TCP socket address for client IP detection — this cannot be spoofed by clients sending fake X-Forwarded-For or X-Real-IP headers
• When TRUST_PROXY=true (for deployments behind Tailscale Serve, Traefik, nginx), proxy headers are trusted as before
• Consolidate duplicate IP extraction logic from server/index.ts into server/middleware/auth.ts as extractClientIp() — single source of truth
• Document proxy trust model and Tailscale Serve header security in README

Changes

File	Change
server/config.ts	Add trustProxy config (env: TRUST_PROXY, default false)
server/middleware/auth.ts	Replace extractIp() with extractClientIp() that respects trustProxy; export for use by index.ts
server/index.ts	Remove duplicate extractRemoteIp(); import extractClientIp from auth; add trustProxy to startup log
README.md	Document TRUST_PROXY flag, deployment matrix, Tailscale Serve header stripping

Security Impact

Before: Any remote client could send X-Forwarded-For: 127.0.0.1 and bypass authentication entirely.

After: By default, proxy headers are ignored. The TCP socket address (from requestIP()) determines the client IP. Only when TRUST_PROXY=true are forwarded headers consulted.

Testing

• Server starts cleanly with trust proxy: false in startup log
• Localhost requests authenticated via TCP socket address (not headers)
• Spoofed X-Forwarded-For headers ignored when TRUST_PROXY=false

[johnwaldo]

This issue has already been resolved in PR #39 (#39).

The fix adds the DASHBOARD_TRUST_PROXY config (default: false) which prevents X-Forwarded-For spoofing attacks.

Closing as duplicate.