af6686ccfa
Behind Docker reverse proxy, request.client.host always returns the proxy container IP (172.20.0.2). Now reads X-Forwarded-For first, then X-Real-IP, falling back to request.client.host.