fix: configure ForwardedHeaders so playground rate limit uses real client IP

Without this, RemoteIpAddress was always 127.0.0.1 (nginx),
making the 10-calls/day limit shared across all users instead of per-IP.
Clears KnownNetworks/KnownProxies to trust Cloudflare's X-Forwarded-For.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/Nalu.Web/Program.cs

@@ -257,6 +257,16 @@ StripeConfiguration.ApiKey = builder.Configuration["Stripe:SecretKey"];
 
 var app = builder.Build();
 
+// ── Forwarded headers (Cloudflare → nginx → app) ─────────────────────────────
+var fwdOpts = new ForwardedHeadersOptions
+{
+    ForwardedHeaders = Microsoft.AspNetCore.HttpOverrides.ForwardedHeaders.XForwardedFor |
+                       Microsoft.AspNetCore.HttpOverrides.ForwardedHeaders.XForwardedProto
+};
+fwdOpts.KnownNetworks.Clear(); // trust all proxies — Cloudflare IPs vary widely
+fwdOpts.KnownProxies.Clear();
+app.UseForwardedHeaders(fwdOpts);
+
 // Initialize MongoDB indexes on startup
 var mongo = app.Services.GetRequiredService<MongoDbContext>();
 await mongo.InitializeAsync();