fix(server): restrict trusted proxy headers

[NateIsern]

Motivation

• A previous change unconditionally enabled one-hop trust proxy, allowing direct clients to spoof X-Forwarded-For and evade per-IP HTTP and WebSocket rate limits.
• The server must treat forwarded headers as authoritative only when the TCP peer is a known, configured reverse proxy so limits remain effective when the backend is directly reachable.

Description

• Replace the hard-coded trust proxy = 1 with an explicit TRUSTED_PROXY_CIDRS allowlist parsed from process.env.TRUSTED_PROXY_CIDRS and used as the Express trust predicate via app.set('trust proxy', isTrustedProxy).
• Add robust IP normalization and CIDR parsing/bitmask logic (IPv4 and IPv6) to build TRUSTED_PROXY_RANGES and the isTrustedProxy check.
• Update WebSocket client IP resolution in resolveClientIp to consult the same isTrustedProxy policy and ignore X-Forwarded-For unless the TCP peer is a trusted proxy.
• Document the new TRUSTED_PROXY_CIDRS setting in .env.example and add the necessary net import in server/index.ts.

Testing

• Ran TypeScript checks with npx tsc -p server/tsconfig.json --noEmit, which completed successfully.
• Executed the test suite with npm test, which completed successfully (all tests passed).
• An alternate npm test -- --runInBand invocation failed because Vitest does not accept the Jest --runInBand flag, but the suite was re-run with npm test and passed.

---

Codex Task