fix(auth): count per-network limits by the visitor behind Caddy

Every per-network limit counted by the connection's address, which behind
Caddy is Caddy's for everyone: new anonymous accounts, codes by mail and
password sign-ins were each limited for the whole instance.

`networkOf` (now `common/network.dart`) takes the last address of
X-Forwarded-For, the one the proxy saw itself, for a connection from a
proxy the operator trusts (`TRUSTED_PROXIES`, which deploy/compose.yaml
sets to Caddy's fixed address); otherwise, or where that is no address,
the connection's. Never the Forwarded header, which Caddy passes on as
sent, so never Serverpod's `remoteInfo`. A value that isn't addresses
stops the server as it starts.

Serverpod's own limit on anonymous accounts counts by the connection's
address too and can't be told otherwise, so it is off; the anonymous
endpoint counts them itself, 30 an hour per network as before.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/README.md

@@ -14,7 +14,7 @@ Endpoints, under the nickname `base` in a host's client (`client.modules.base.em
 
 | Endpoint | Methods | Who may call |
 |---|---|---|
-| `anonymousIdp` | `login` (Serverpod's anonymous sign-in, at most 30 new accounts per IP address and hour) | anyone |
+| `anonymousIdp` | `login` (Serverpod's anonymous sign-in, at most 30 new accounts per network and hour) | anyone |
 | `password` | `set`: the caller's password, with the address a mailed code proves unless they have one | signed in |
 | `passwordSignIn` | `begin`, `complete`: SRP-6a's two steps with a code from an authenticator (or a recovery code); a session | without a session |
 | `authenticator` | `enrol`, `confirm` (the first brings ten recovery codes), `list`, `remove`, `newRecoveryCodes` | signed in |
@@ -41,6 +41,14 @@ Endpoints, under the nickname `base` in a host's client (`client.modules.base.em
   `https://<account domain>/@handle` (`ACCOUNT_DOMAIN`, else the server's public host),
   served by `addProfilePageRoute`, in English or German, its foot what the host's
   `profilePageNote` says.
+- **Per-network limits** (new anonymous accounts, codes by mail, password sign-ins,
+  proofs of the recovery phrase) count by the visitor's IP address (`networkOf`): the
+  connection's, or, for a connection from a proxy the operator trusts
+  (`TRUSTED_PROXIES`), the last address of `X-Forwarded-For`, the one the proxy saw
+  itself. Never the `Forwarded` header, which Caddy passes on as the visitor wrote it,
+  so never Serverpod's `remoteInfo`. Serverpod's own limit on anonymous accounts is off
+  (it counts by the connection's address, behind a proxy the proxy's for everyone); the
+  endpoint counts them itself.
 - Refusals are `PasswordRefusedException`, `GitHubSignInRefusedException`,
   `EmailSignInRefusedException` and `ProfileRefusedException`, each with a reason;
   `ProfileNotFoundException` where there is no profile.
@@ -283,7 +291,11 @@ its app's). The environment: `ACCOUNT_REGISTER_URL` and `INSTANCE_MEMBERS` (abov
 one; `GITHUB_SIGN_IN_ENDS`, the day GitHub stops signing anyone in (`2027-01-22`);
 `SOURCE_URL`, `DATA_LOCATION`, `BACKUP_LOCATION`: where the instance keeps people's data
 and its backups, each `EU`, a country's code (`DE`) or a subdivision's (ISO 3166-2,
-`US-CA`, `DE-BY`), the backups also `none`; where the disks are, not which law governs.
+`US-CA`, `DE-BY`), the backups also `none`; where the disks are, not which law governs;
+`TRUSTED_PROXIES`, the addresses of the reverse proxies in front of the server (Caddy's
+on its compose network, which Halkyon Learn's `deploy/compose.yaml` sets), separated by
+commas or spaces: without, every visitor behind the proxy shares each per-network limit;
+anything but addresses stops the server (`addInstanceRoutes`).
 
 ## Developing it