fix(auth): key rate limits on the resolved client IP and restrict the Expo auth proxy

Resolve the client IP from the TCP peer plus trusted-proxy X-Forwarded-For hops
(TRUSTED_PROXIES) and hand it to Better Auth in an internal header, so spoofed
forwarding headers can no longer rotate sign-in rate-limit buckets. The Expo
authorization proxy now only redirects to the OIDC provider's authorization endpoint.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.env.example

@@ -27,6 +27,13 @@ BETTER_AUTH_URL=http://localhost:3000
 # OIDC_AUTO_REGISTER=true       # Auto-create users on first OIDC login (default: true)
 # DISABLE_PASSWORD_LOGIN=false  # Set to "true" to hide email/password form when OIDC is configured
 
+# ─── Reverse Proxy (optional) ───────────────────────────────────────────
+# Proxies whose X-Forwarded-For hops are trusted when rate-limiting sign-ins.
+# Default: loopback and private ranges (a proxy on the same host/Docker network).
+# Add your proxy's IP/CIDR if it is elsewhere (e.g. Cloudflare's ranges when
+# Cloudflare connects straight to Sofa), or set "none" to ignore forwarded headers.
+# TRUSTED_PROXIES=127.0.0.0/8,::1/128,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7
+
 # ─── Logging ──────────────────────────────────────────────────────────
 # Log verbosity: error, warn, info, debug (default: info)
 # LOG_LEVEL=info