fix(http): use single hop trust proxy to prevent rate limit bypass

[ClemRz]

🤔 What

• Change trustProxy from true to 1 in config/env/production.js

🤷‍♂️ Why

express-rate-limit v7+ rejects trustProxy: true because it trusts all proxies unconditionally, allowing attackers to spoof X-Forwarded-For and bypass IP-based rate limiting (ERR_ERL_PERMISSIVE_TRUST_PROXY).

Setting it to 1 tells Express to trust exactly one proxy hop (the Azure App Service load balancer), which still resolves req.ip to the real client IP while preventing spoofing.

🔍 How

Single-line change: trustProxy: true → trustProxy: 1. Express interprets the number as "trust the nth hop from the front-facing proxy," which is the correct setting for Azure App Service's single LB architecture.

🧪 Testing

After deployment, verify:

1. Logs show real client IPs (not 169.254.129.1)
2. The ERR_ERL_PERMISSIVE_TRUST_PROXY validation error is gone
3. Rate limiting still works correctly

📸 Previews

N/A