Harden auth against a forwarded-header rate-limit bypass, and guard BYOK SSRF

The per-IP rate limits could be bypassed entirely: uvicorn ran with
--forwarded-allow-ips "*", which trusts the leftmost X-Forwarded-For value
(client-controlled), and Render forwards the inbound header rather than
stripping it. Rotating the header handed out a fresh rate-limit bucket per
request, so the login/register limit (10/5min) and guest-minting limit
(30/5min) were no throttle at all — unbounded password guessing and guest-row
creation. Confirmed live: fixed IP -> 429 after 10; rotating spoofed header ->
no 429 across 14 attempts.

Two-layer fix:
- limits._client_ip now derives the client IP from the hop the trusted edge
  appends (rightmost of X-Forwarded-For), which a client can't spoof past;
  tunable via AIDND_TRUSTED_PROXY_HOPS. Dropped --forwarded-allow-ips "*".
- New per-account login throttle (email-keyed, 8 fails / 15 min, cleared on
  success): stops distributed guessing against one account that a per-IP limit
  can't, since it can't be diluted across many source addresses.

Also close an SSRF on the BYOK endpoint_url (hosted mode only): the connection
test and turn/chat streams now refuse a URL that resolves to a non-public
address (private/loopback/link-local metadata/reserved), checked at request
time so it resists a DNS record flipping to a private IP. No-op locally, where
reaching localhost Ollama is intended.

Tests: test_ratelimit_hardening.py (8), test_netguard.py (13). 172 pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015CYEJKobJ2Re4Dv7qUoSA7

Dockerfile

@@ -33,9 +33,14 @@ VOLUME /data
 
 EXPOSE 8000
 WORKDIR /app/backend
-# --proxy-headers: behind a reverse proxy (any hosted deploy), trust
-# X-Forwarded-For so per-IP rate limits key on the client, not the proxy.
+# --proxy-headers lets uvicorn fix up the request scheme (https) behind the
+# platform's edge. We deliberately do NOT pass --forwarded-allow-ips "*": that
+# made uvicorn trust the LEFTMOST X-Forwarded-For value, which the client fully
+# controls, so anyone could rotate the header to dodge the per-IP rate limits.
+# The client IP used for rate limiting is derived in limits._client_ip from the
+# hop the edge appends (rightmost), which a client cannot spoof past; tune with
+# AIDND_TRUSTED_PROXY_HOPS if the platform adds more proxy hops.
 # Single worker on purpose: the turn lock, rate limiter, and debug log are
 # in-process state.
 CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000", \
-     "--proxy-headers", "--forwarded-allow-ips", "*"]
+     "--proxy-headers"]