Harden auth against a forwarded-header rate-limit bypass, and guard BYOK SSRF

The per-IP rate limits could be bypassed entirely: uvicorn ran with
--forwarded-allow-ips "*", which trusts the leftmost X-Forwarded-For value
(client-controlled), and Render forwards the inbound header rather than
stripping it. Rotating the header handed out a fresh rate-limit bucket per
request, so the login/register limit (10/5min) and guest-minting limit
(30/5min) were no throttle at all — unbounded password guessing and guest-row
creation. Confirmed live: fixed IP -> 429 after 10; rotating spoofed header ->
no 429 across 14 attempts.

Two-layer fix:
- limits._client_ip now derives the client IP from the hop the trusted edge
  appends (rightmost of X-Forwarded-For), which a client can't spoof past;
  tunable via AIDND_TRUSTED_PROXY_HOPS. Dropped --forwarded-allow-ips "*".
- New per-account login throttle (email-keyed, 8 fails / 15 min, cleared on
  success): stops distributed guessing against one account that a per-IP limit
  can't, since it can't be diluted across many source addresses.

Also close an SSRF on the BYOK endpoint_url (hosted mode only): the connection
test and turn/chat streams now refuse a URL that resolves to a non-public
address (private/loopback/link-local metadata/reserved), checked at request
time so it resists a DNS record flipping to a private IP. No-op locally, where
reaching localhost Ollama is intended.

Tests: test_ratelimit_hardening.py (8), test_netguard.py (13). 172 pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015CYEJKobJ2Re4Dv7qUoSA7

backend/app/netguard.py

@@ -0,0 +1,51 @@
+"""SSRF guard for the one place the server makes an outbound request to a
+user-supplied address: the BYOK `endpoint_url` (connection test + turns/chat).
+
+Without this, a hosted user could point endpoint_url at an internal service or
+the cloud metadata endpoint (169.254.169.254) and have the server fetch it —
+the connection test even echoes part of the response back. We refuse any URL
+that resolves to a non-public address.
+
+No-op in local mode: a local install talking to http://localhost:11434 (Ollama)
+is the normal, intended case — the guard only applies to the hosted, multi-user
+deployment where the endpoint comes from an untrusted visitor.
+"""
+
+import ipaddress
+import socket
+from urllib.parse import urlparse
+
+from . import auth
+
+
+def endpoint_block_reason(url: str) -> str | None:
+    """A human-readable reason this URL must NOT be fetched server-side, or None
+    if it's allowed. Resolves the host and rejects it if any resulting address
+    is non-public (private, loopback, link-local/metadata, reserved, …).
+
+    Checking at request time (not just on save) is deliberate: it resists a DNS
+    record that flips to a private IP after the value was stored.
+    """
+    if not auth.MULTI_USER:
+        return None
+    parsed = urlparse(url)
+    if parsed.scheme not in ("http", "https"):
+        return "the endpoint URL must start with http:// or https://"
+    host = parsed.hostname
+    if not host:
+        return "the endpoint URL has no host"
+    port = parsed.port or (443 if parsed.scheme == "https" else 80)
+    try:
+        infos = socket.getaddrinfo(host, port, type=socket.SOCK_STREAM)
+    except socket.gaierror:
+        return "the endpoint host could not be resolved"
+    for info in infos:
+        try:
+            ip = ipaddress.ip_address(info[4][0])
+        except ValueError:
+            return "the endpoint host resolved to an unrecognized address"
+        # is_global is the strict allowlist: private/loopback/link-local/CGNAT
+        # all report False, so this one check covers the metadata IP too.
+        if not ip.is_global or ip.is_multicast or ip.is_reserved:
+            return "the endpoint URL resolves to a non-public address"
+    return None