fix: per-IP auth rate limiting instead of one global bucket

A single global token bucket let one attacker at the sustained rate 429
every user's login/register/change-password. Key buckets by client IP: the
SvelteKit proxy now stamps the real peer address onto X-Forwarded-For
(overriding any client-supplied value, anti-spoof), and axum reads it via a
ClientIp extractor — but only when AUTH_TRUSTED_PROXY is set, else it falls
back to the shared bucket (today's behavior). The per-IP map is bounded
(10k IPs, idle buckets pruned) so a spoofed-IP spray can't grow it.

AUTH_TRUSTED_PROXY defaults false (safe for a directly-exposed backend);
compose sets it true since the proxy is the single trusted hop.

Bump to 0.124.12.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -80,6 +80,10 @@ services:
       SESSION_TTL_DAYS: ${SESSION_TTL_DAYS:-30}
       AUTH_RATE_PER_SEC: ${AUTH_RATE_PER_SEC:-5}
       AUTH_RATE_BURST: ${AUTH_RATE_BURST:-10}
+      # The SvelteKit container is the single trusted hop in front of the
+      # backend and stamps the real client IP, so per-IP rate limiting is on
+      # by default here (unlike the backend's safe-by-default `false`).
+      AUTH_TRUSTED_PROXY: ${AUTH_TRUSTED_PROXY:-true}
       # CORS — same-origin by default; populate when serving the API on
       # a different host than the frontend.
       CORS_ALLOWED_ORIGINS: ${CORS_ALLOWED_ORIGINS:-}