fix: resolve real visitor IP via CF-Connecting-IP for per-IP limiting

websocket.client.host is always the Cloudflare Tunnel machine's LAN IP for
every internet-facing connection (the tunnel runs on a separate machine and
terminates TLS there), which collapsed per-IP rate limiting into a single
shared bucket for all remote visitors — the exact gap flagged in review.

Cloudflare's edge sets CF-Connecting-IP itself, overwriting any
client-supplied value, so it's safe to trust when present. Falls back to
the raw socket peer for direct LAN/local access.

backend/app/rate_limit.py

@@ -1,5 +1,24 @@
 import time
 from collections import defaultdict
+from typing import Mapping
+
+
+def resolve_client_ip(headers: Mapping[str, str], direct_host: str | None) -> str:
+    """Resolves the real visitor IP for per-IP rate limiting.
+
+    The App CT sits behind a Cloudflare Tunnel that runs on a separate
+    machine (see README Architecture) — every internet-facing connection's
+    raw TCP peer is that tunnel machine, not the visitor, which would
+    collapse per-IP limiting to a single shared bucket for all remote
+    traffic. Cloudflare's edge sets `CF-Connecting-IP` itself, stripping any
+    client-supplied value first, so it's safe to trust here. Direct
+    LAN/local access (no Cloudflare in front, e.g. local dev) has no such
+    header and falls back to the raw socket peer.
+    """
+    forwarded = headers.get("cf-connecting-ip")
+    if forwarded:
+        return forwarded
+    return direct_host or "unknown"
 
 
 class RateLimiter: