fix(website): preserve client IP when proxying

removeCFHeaders drops every cf-* header, including cf-connecting-ip, so
proxied origins saw only the pod's IP. Capture it before the strip and
forward it as x-forwarded-for/x-real-ip.

Affects every site using website/handlers/proxy.ts, including the VTEX
proxy routes and A/B testing via the abTesting prop, where the origin
otherwise loses geo, rate limiting, analytics and fraud signals.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: nicacioliveira

website/handlers/proxy.ts

@@ -145,7 +145,19 @@ export default function Proxy({
     if (isFreshCtx<DecoSiteState>(_ctx)) {
       _ctx?.state?.monitoring?.logger?.log?.("proxy received headers", headers);
     }
+    // cf-connecting-ip carries the real client IP, and removeCFHeaders is about
+    // to drop it. Forward it as x-forwarded-for/x-real-ip so the proxied origin
+    // still sees who the visitor is (geo, rate limiting, analytics, fraud).
+    const clientIp = headers.get("cf-connecting-ip");
     removeCFHeaders(headers); // cf-headers are not ASCII-compliant
+    if (clientIp) {
+      const forwardedFor = headers.get("x-forwarded-for");
+      headers.set(
+        "x-forwarded-for",
+        forwardedFor ? `${clientIp}, ${forwardedFor}` : clientIp,
+      );
+      headers.set("x-real-ip", clientIp);
+    }
     if (removeDirtyCookies) {
       removeDirtyCookiesFn(headers);
     }