test+docs: tighten H1 assertions, cover secret/XFF edges, document boot & SSE-ban

Re-review follow-ups (non-blocking quality items):

Tests:
- moderation H1 specs now assert exact `→ 403` instead of bare .rejects.toThrow(),
  so a spurious 500 can no longer masquerade as "revocation worked".
- config: added case-insensitivity (upper/mixed-case placeholder) and the
  len==32/31 boundary cases for validate_secrets.
- rate_limiter: added the trailing-comma empty-entry case for client_ip (must
  fall back, not return "").
  (Backend unit tests: 35 pass.)

Docs:
- README: note that with APP_ENV=production a placeholder .env makes the app
  refuse to boot and Caddy wait unhealthy — reason is in `docker compose logs app`.
- SECURITY-BACKLOG + sse.rs comment: document that a mid-session ban does not
  tear down an already-open SSE stream (new tickets are blocked; low blast radius).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/services/rate_limiter.rs

@@ -167,4 +167,14 @@ mod tests {
     fn client_ip_falls_back_when_header_absent() {
         assert_eq!(client_ip(&HeaderMap::new(), "127.0.0.1"), "127.0.0.1");
     }
+
+    #[test]
+    fn client_ip_falls_back_on_trailing_comma_empty_entry() {
+        // A trailing comma leaves an empty right-most segment after trimming; the
+        // `.filter(!is_empty)` must reject it and fall through to the fallback
+        // rather than returning "" (which would collapse callers into one bucket).
+        let mut h = HeaderMap::new();
+        h.insert("x-forwarded-for", "203.0.113.7, ".parse().unwrap());
+        assert_eq!(client_ip(&h, "127.0.0.1"), "127.0.0.1");
+    }
 }