fix: enforce trusted rate-limit identities

[smiggleworth]

Summary

• upgrade to released @askrjs/node@0.0.11 peer authentication
• key both IP controls through one adapter-authenticated client-address helper
• remove all application trust in X-Forwarded-For
• document the direct-listener and reverse-proxy security boundary
• prove contact and authentication limits through a real Node listener

Linked issue

Closes #10

Prerequisite

• Expose a non-spoofable TCP peer address to Node-hosted apps askr-node#21 / fix: authenticate Node client addresses askr-node#22, released as @askrjs/node@0.0.11

TDD

• Red 0614414: rotating XFF yields four contact successes/four rows and six unrestricted bad logins.
• Green 04b0e1b: both sinks use the TCP peer stamped at the Node adapter boundary; expected 429s engage.
• Bypass audit fa47186: rotating authentication email casing remains one canonical limiter key.

Security boundary and guardrails

• attacker controls incoming headers and request casing
• Node adapter overwrites its reserved header from the TCP socket
• Destroyer reads only that reserved header, through one helper
• real listener regression covers ten spoofed requests across both security sinks
• reverse-proxy behavior is fail-closed and explicitly documented

Acceptance audit

• Every acceptance criterion in Rate limiters trivially bypassed via spoofed X-Forwarded-For header #10 is checked with evidence.
• Local npm run acceptance passes 18 unit/full-stack tests, builds, 3 production-artifact tests, and 6 browser product/heap tests.
• Runtime dependency audit reports zero vulnerabilities.
• Exact-head hosted CI passes on Ubuntu, macOS, Windows, and the browser lane.
• Exact squash merge and post-merge main CI verified (private app; no package publication).

Local verification

• npm run acceptance
• npm audit --omit=dev

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[smiggleworth]

Release closure verified:

• squash merge 23d25c86bfde49e63fcaf976548e6953e8e0f661
• exact merged-head main CI run 31905581166 passed on Ubuntu, macOS, Windows, and the browser product lane
• Destroyer is a private application with no package publish workflow; the production build and product flows are the release artifact gates

Security outcome: fixed. The application no longer consumes attacker-controlled forwarding metadata at either limiter sink, and the real-listener spoof/canonicalization regression permanently covers the bypass class.