Harden auth against a forwarded-header rate-limit bypass, and guard BYOK SSRF

The per-IP rate limits could be bypassed entirely: uvicorn ran with
--forwarded-allow-ips "*", which trusts the leftmost X-Forwarded-For value
(client-controlled), and Render forwards the inbound header rather than
stripping it. Rotating the header handed out a fresh rate-limit bucket per
request, so the login/register limit (10/5min) and guest-minting limit
(30/5min) were no throttle at all — unbounded password guessing and guest-row
creation. Confirmed live: fixed IP -> 429 after 10; rotating spoofed header ->
no 429 across 14 attempts.

Two-layer fix:
- limits._client_ip now derives the client IP from the hop the trusted edge
  appends (rightmost of X-Forwarded-For), which a client can't spoof past;
  tunable via AIDND_TRUSTED_PROXY_HOPS. Dropped --forwarded-allow-ips "*".
- New per-account login throttle (email-keyed, 8 fails / 15 min, cleared on
  success): stops distributed guessing against one account that a per-IP limit
  can't, since it can't be diluted across many source addresses.

Also close an SSRF on the BYOK endpoint_url (hosted mode only): the connection
test and turn/chat streams now refuse a URL that resolves to a non-public
address (private/loopback/link-local metadata/reserved), checked at request
time so it resists a DNS record flipping to a private IP. No-op locally, where
reaching localhost Ollama is intended.

Tests: test_ratelimit_hardening.py (8), test_netguard.py (13). 172 pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015CYEJKobJ2Re4Dv7qUoSA7

backend/tests/test_netguard.py

@@ -0,0 +1,69 @@
+"""Tests for the SSRF guard on the user-supplied BYOK endpoint_url.
+
+    python -m pytest tests/test_netguard.py -v
+"""
+import os
+import tempfile
+
+_tmp = tempfile.NamedTemporaryFile(suffix=".db", delete=False)
+_tmp.close()
+os.environ["AIDND_DB_PATH"] = _tmp.name
+os.environ.pop("AIDND_DATABASE_URL", None)
+os.environ.pop("DATABASE_URL", None)
+
+import pytest
+
+from app import auth, netguard
+
+
+@pytest.fixture
+def hosted(monkeypatch):
+    monkeypatch.setattr(auth, "MULTI_USER", True)
+
+
+def _resolves_to(monkeypatch, ip: str):
+    """Pin getaddrinfo so we test the address decision, not real DNS."""
+    monkeypatch.setattr(
+        netguard.socket, "getaddrinfo",
+        lambda *a, **k: [(2, 1, 6, "", (ip, 443))],
+    )
+
+
+@pytest.mark.parametrize("ip", [
+    "127.0.0.1",          # loopback
+    "169.254.169.254",    # cloud metadata (link-local)
+    "10.0.0.5",           # RFC1918
+    "192.168.1.1",        # RFC1918
+    "172.16.0.9",         # RFC1918
+    "0.0.0.0",            # unspecified
+    "100.64.0.1",         # carrier-grade NAT
+    "::1",                # IPv6 loopback
+    "fd00::1",            # IPv6 unique-local
+])
+def test_blocks_non_public_addresses(hosted, monkeypatch, ip):
+    _resolves_to(monkeypatch, ip)
+    assert netguard.endpoint_block_reason("https://evil.example.com/v1") is not None
+
+
+def test_allows_public_address(hosted, monkeypatch):
+    _resolves_to(monkeypatch, "104.18.0.1")  # a public IP
+    assert netguard.endpoint_block_reason("https://openrouter.ai/api/v1") is None
+
+
+def test_rejects_non_http_scheme(hosted):
+    assert netguard.endpoint_block_reason("file:///etc/passwd") is not None
+    assert netguard.endpoint_block_reason("gopher://x/") is not None
+
+
+def test_unresolvable_host_is_blocked(hosted, monkeypatch):
+    def boom(*a, **k):
+        raise netguard.socket.gaierror("no such host")
+    monkeypatch.setattr(netguard.socket, "getaddrinfo", boom)
+    assert netguard.endpoint_block_reason("https://nope.invalid/v1") is not None
+
+
+def test_noop_in_local_mode(monkeypatch):
+    monkeypatch.setattr(auth, "MULTI_USER", False)
+    # Local installs legitimately reach localhost (Ollama) — never blocked.
+    assert netguard.endpoint_block_reason("http://localhost:11434/v1") is None
+    assert netguard.endpoint_block_reason("http://127.0.0.1:11434/v1") is None