Harden auth against a forwarded-header rate-limit bypass, and guard BYOK SSRF

The per-IP rate limits could be bypassed entirely: uvicorn ran with
--forwarded-allow-ips "*", which trusts the leftmost X-Forwarded-For value
(client-controlled), and Render forwards the inbound header rather than
stripping it. Rotating the header handed out a fresh rate-limit bucket per
request, so the login/register limit (10/5min) and guest-minting limit
(30/5min) were no throttle at all — unbounded password guessing and guest-row
creation. Confirmed live: fixed IP -> 429 after 10; rotating spoofed header ->
no 429 across 14 attempts.

Two-layer fix:
- limits._client_ip now derives the client IP from the hop the trusted edge
  appends (rightmost of X-Forwarded-For), which a client can't spoof past;
  tunable via AIDND_TRUSTED_PROXY_HOPS. Dropped --forwarded-allow-ips "*".
- New per-account login throttle (email-keyed, 8 fails / 15 min, cleared on
  success): stops distributed guessing against one account that a per-IP limit
  can't, since it can't be diluted across many source addresses.

Also close an SSRF on the BYOK endpoint_url (hosted mode only): the connection
test and turn/chat streams now refuse a URL that resolves to a non-public
address (private/loopback/link-local metadata/reserved), checked at request
time so it resists a DNS record flipping to a private IP. No-op locally, where
reaching localhost Ollama is intended.

Tests: test_ratelimit_hardening.py (8), test_netguard.py (13). 172 pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015CYEJKobJ2Re4Dv7qUoSA7

backend/app/providers/openai_compatible.py

@@ -3,7 +3,7 @@ from typing import AsyncIterator
 
 import httpx
 
-from .. import debuglog
+from .. import debuglog, netguard
 from .base import PromptParts, Provider, ProviderError
 
 # Framing appended after the story text in chat mode, so chat-tuned models keep
@@ -168,6 +168,11 @@ class OpenAICompatibleProvider(Provider):
     async def _stream(self, url: str, body: dict) -> AsyncIterator[tuple[str, str]]:
         """Shared SSE plumbing for generate()/chat(): POST a streaming request
         and yield ("text" | "reasoning", chunk) pairs, logging the exchange."""
+        # SSRF guard (hosted mode): a user-supplied endpoint_url must not point
+        # at an internal/metadata address. No-op for local installs.
+        reason = netguard.endpoint_block_reason(url)
+        if reason:
+            raise ProviderError(f"This endpoint can't be used — {reason}.")
         log = debuglog.start_entry(url, self.model, body)
         received: list[str] = []
         try: