fix: correct X-Forward-For typo to X-Forwarded-For in nginx configs

[cybertron288]

Closes #8934

What

Corrects the real_ip_header directive in apps/web, apps/admin, and apps/space nginx configs from the non-existent X-Forward-For header to the standard X-Forwarded-For.

Why

X-Forward-For is not a real HTTP header, so nginx never replaces $remote_addr with the actual client IP. As a result, limit_req_zone $binary_remote_addr rate-limits per-proxy instead of per-client and access logs record the proxy IP. See #8934.

Notes

• Opened as draft — please review before marking ready.
• Verification: changes are limited to three nginx config files; no app code touched. Did not run nginx locally.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 669f7de2-ddd6-49ef-8080-cf86806964f0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sriramveeraghanta]

This PR #8935 already fixes this.