fix: use rightmost XFF entry in rate limiter to prevent IP spoofing

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/api/auth/[...nextauth]/route.ts

@@ -12,7 +12,8 @@ function getClientIp(request: NextRequest): string {
   // In production, ensure your reverse proxy (Caddy) sets these headers correctly
   const forwarded = request.headers.get("x-forwarded-for");
   if (forwarded) {
-    return forwarded.split(",")[0]?.trim() || "unknown";
+    const parts = forwarded.split(",");
+    return parts[parts.length - 1]?.trim() || "unknown";
   }
   const real = request.headers.get("x-real-ip");
   if (real) {