fix(sec/d24): nginx sends X-Forwarded-For as $remote_addr (replace, not append)

With the app's trust-proxy=1, an appended client-supplied XFF header would let a
caller spoof req.ip and bypass the per-IP login/reveal rate limiters. Replacing
with $remote_addr (the unforgeable socket peer) keys the limiters on the true
client.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

deploy/sims.hq.conf

@@ -24,7 +24,12 @@ server {
         proxy_pass http://127.0.0.1:5182;
         proxy_set_header Host              $host;
         proxy_set_header X-Real-IP         $remote_addr;
-        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        # REPLACE, do not append (D24 red-team). With the app's `trust proxy 1`, Express
+        # reads the last X-Forwarded-For hop as the client IP. $proxy_add_x_forwarded_for
+        # would append to a CLIENT-SUPPLIED header, letting a caller inject a fake IP and
+        # bypass the per-IP login/reveal rate limiters. $remote_addr is the real socket
+        # peer and cannot be forged, so the app always keys limits on the true client.
+        proxy_set_header X-Forwarded-For   $remote_addr;
         proxy_set_header X-Forwarded-Proto $scheme;
     }
 }