security: don't trust X-Forwarded-For except from trusted proxies

[sophiaeagent-beep]

This is a red-team hardening fix.

Problem:

• The node trusted X-Forwarded-For unconditionally to determine client IP.
• Attackers can spoof this header directly when hitting the node, which undermines:
  • hardware binding anti-multiwallet logic (IP is part of the hardware_id)
  • logs / any per-IP gating

Fix:

• Adds client_ip_from_request(request) with RC_TRUSTED_PROXIES allowlist.
• Only uses X-Forwarded-For when the TCP peer (remote_addr) is trusted.
• Replaces all direct X-Forwarded-For usages with the helper.

Config:

• RC_TRUSTED_PROXIES="127.0.0.1,::1,10.0.0.0/8"

Impact:

• If you're behind nginx on the same host (common), it keeps working.
• If you're not behind a trusted proxy, spoofed XFF stops working (desired).