feat: trust proxy client addresses safely

[HoungDev]

Summary

• make forwarded-header trust fail closed with an explicit IP/CIDR allowlist
• canonicalize the ASGI client address shared by rate limiting and request logs
• harden the documented Nginx boundary against client-supplied X-Forwarded-For
• add spoofing, proxy-chain, malformed-address, configuration, and integration tests

Security model

Uvicorn remains the single owner of forwarded-header parsing. It accepts forwarded headers only when the direct socket peer matches FORWARDED_ALLOW_IPS; the application then consumes the canonical ASGI client address without parsing the headers a second time. Wildcard, malformed, non-canonical, and empty allowlist entries are rejected.

Validation

• ruff format --check .
• ruff check .
• 46 focused tests passed locally
• full PostgreSQL/Redis suite delegated to GitHub Actions because those services are unavailable locally