feat: django-axes prefers forwarded ip address

[charn]

Prioritize HTTP_X_FORWARDED_FOR for django-axes similar to audit logs with the get_client_ip.

https://django-axes.readthedocs.io/en/latest/4_configuration.html#configuring-reverse-proxies

Refs: PT-2026

[azure-pipelines]

KULTUS-API branch is deployed to platta: https://kultus-pr481.api.dev.hel.ninja 🚀🚀🚀

[sentry]

Bug: The AXES_IPWARE_PROXY_COUNT is hardcoded to 1, creating an IP spoofing vulnerability in local development and causing incorrect IP detection in multi-proxy environments.
_{Severity: HIGH}

Suggested Fix

Make the AXES_IPWARE_PROXY_COUNT setting configurable via an environment variable, similar to other infrastructure-dependent settings like USE_X_FORWARDED_HOST. This allows each deployment environment (local, staging, production) to specify the correct number of proxies.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: palvelutarjotin/settings.py#L451

Potential issue: The setting `AXES_IPWARE_PROXY_COUNT` is hardcoded to `1`. This assumes
a fixed infrastructure with exactly one reverse proxy, which is not guaranteed across
all deployment environments. In local development environments without a proxy, this
configuration makes the `django-axes` rate-limiting feature vulnerable to IP spoofing,
as it will incorrectly trust a client-supplied `X-Forwarded-For` header. Conversely, in
production environments with more than one proxy, it will identify an intermediate
proxy's IP instead of the actual client's, undermining the effectiveness of rate
limiting.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[azure-pipelines]

KULTUS-API branch is deployed to platta: https://kultus-pr481.api.dev.hel.ninja 🚀🚀🚀