sec: parse X-Forwarded-For from trusted proxies via WIREFAN_TRUSTED_PROXIES

[EthanY33]

Summary

Fixes #9.

clientIP returned RemoteAddr unconditionally. Behind the documented Caddy deployment every connection is 127.0.0.1, so defaultIPCap = 200 is a global cap — one attacker exhausts the slot pool for everyone.

Adds opt-in X-Forwarded-For parsing using rightmost-untrusted-hop:

• New env WIREFAN_TRUSTED_PROXIES, comma-separated CIDRs or single IPs (e.g. 127.0.0.1,10.0.0.0/8). Single IPs become /32 (IPv4) or /128 (IPv6).
• When RemoteAddr is in trustedProxies, walk X-Forwarded-For right-to-left and return the first hop whose IP is not in trustedProxies. The leftmost entry is never authoritative — clients can pick that themselves.
• When trustedProxies is empty (default), behavior is unchanged: XFF is ignored.

What changed

• internal/server/upgrade.go:
  • UpgradeHandler gains trustedProxies []netip.Prefix, populated from WIREFAN_TRUSTED_PROXIES at construction.
  • New parseTrustedProxies, addrInPrefixes, stripHostPort helpers.
  • clientIP takes trustedProxies and parses XFF when the source is trusted.
• internal/server/upgrade_test.go:
  • TestParseTrustedProxies (CIDR / bare IP / malformed dropped)
  • TestClientIPNoTrust (XFF ignored without trust)
  • TestClientIPTrustedProxyPicksRightmostUntrusted (six scenarios)

Operator notes

# behind Caddy on the same host
WIREFAN_TRUSTED_PROXIES=127.0.0.1 ./wirefan

# behind a private subnet of proxies
WIREFAN_TRUSTED_PROXIES=10.0.0.0/8,192.168.0.0/16 ./wirefan

The Caddyfile already sets X-Forwarded-For; setting the env makes the per-IP cap actually per-client-IP again.

Test plan

• go build ./... clean.
• go test ./internal/server/... passes (existing + 8 new cases).
• Manual: start with WIREFAN_TRUSTED_PROXIES=127.0.0.1, send curl -H "X-Forwarded-For: 1.2.3.4" localhost:8080/v1/connect?key=... from loopback → metrics show source IP 1.2.3.4, not 127.0.0.1.

Conflict notes

This PR touches internal/server/upgrade.go (also touched by #16 sanitize-logs). Conflicts are minimal — different lines — and git merge should resolve cleanly. Whichever lands first, the other will need a trivial rebase.