feat: trust forwarded client addresses only from configured proxies (rate limit, audit, SSE) [CI]

Docs: access.md covers the missing node-side Backend identity and the hash-first install flow.

backend/src/MoShiro.Backend.Application/BackendOptions.cs

@@ -50,6 +50,15 @@ public sealed class BackendOptions
     /// </summary>
     public string? CorsOrigins { get; set; }
 
+    /// <summary>
+    /// 可信的反向代理（逗号分隔的 IP 或 CIDR，如 <c>127.0.0.1,172.16.0.0/12</c>）。只有从这些地址连进来的请求，才采信
+    /// <see cref="TrustedProxyHeader"/> 里的客户端地址（用于登录限流、审计和 SSE 限制）；空 = 不信任任何转发头，用套接字地址。
+    /// </summary>
+    public string? TrustedProxies { get; set; }
+
+    /// <summary>携带客户端地址的头，缺省 <c>X-Forwarded-For</c>（Cloudflare 单独的 <c>CF-Connecting-IP</c> 也可以填这里）。</summary>
+    public string? TrustedProxyHeader { get; set; }
+
     public TimeSpan SessionLifetime { get; set; } = TimeSpan.FromHours(12);
 
     public int LoginAttemptsPerMinute { get; set; } = 10;