fix(website): do not duplicate client IP in x-forwarded-for

Measured on a live pod: x-forwarded-for already reaches the handler with
the client IP as its first entry, so unconditionally prepending it
produced a duplicate. Only seed the header when absent, and always set
x-real-ip, which was the header actually missing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: nicacioliveira

website/handlers/proxy.ts

@@ -145,17 +145,18 @@ export default function Proxy({
     if (isFreshCtx<DecoSiteState>(_ctx)) {
       _ctx?.state?.monitoring?.logger?.log?.("proxy received headers", headers);
     }
-    // cf-connecting-ip carries the real client IP, and removeCFHeaders is about
-    // to drop it. Forward it as x-forwarded-for/x-real-ip so the proxied origin
-    // still sees who the visitor is (geo, rate limiting, analytics, fraud).
+    // cf-connecting-ip carries the real client IP and removeCFHeaders is about
+    // to drop it, leaving the proxied origin without x-real-ip. x-forwarded-for
+    // usually already arrives with the client IP first, so only fill the gaps.
     const clientIp = headers.get("cf-connecting-ip");
     removeCFHeaders(headers); // cf-headers are not ASCII-compliant
     if (clientIp) {
       const forwardedFor = headers.get("x-forwarded-for");
-      headers.set(
-        "x-forwarded-for",
-        forwardedFor ? `${clientIp}, ${forwardedFor}` : clientIp,
-      );
+      if (!forwardedFor) {
+        headers.set("x-forwarded-for", clientIp);
+      } else if (forwardedFor.split(",")[0].trim() !== clientIp) {
+        headers.set("x-forwarded-for", `${clientIp}, ${forwardedFor}`);
+      }
       headers.set("x-real-ip", clientIp);
     }
     if (removeDirtyCookies) {