fix: harden WebSocket limits (maxPayload + use TCP peer IP)

[NateIsern]

Motivation

• A public /api/ws endpoint accepted large frames (ws default ~100 MiB) and trusted attacker-controlled X-Forwarded-For values for per-IP connection limits, enabling unauthenticated DoS vectors.
• The change hardens the WebSocket surface by bounding accepted message size and keying connection accounting to the TCP peer address so attackers cannot spoof per-IP buckets.

Description

• Add a new configurable environment option WEBSOCKET_MAX_PAYLOAD_BYTES (default 65536) and document it in .env.example and README.md.
• Pass the configured payload limit into the WebSocketServer via its maxPayload option to limit accepted frame size.
• Replace the previous X-Forwarded-For based logic with a resolveClientIp implementation that returns the TCP peer address (socket.remoteAddress) so per-IP connection caps cannot be bypassed by spoofed headers.
• All changes are confined to server/index.ts, plus the environment/example docs in .env.example and README.md.

Testing

• Ran the TypeScript typecheck with npm run typecheck which completed successfully.
• Executed the test suite with npm test (Vitest) and all tests passed (42 passed).

---

Codex Task