Per owner decision the optional proxy-header escape hatch is dead config:
remove the env var, its plumbing (Config.TrustedIPHeader, SetTrustedIPHeader),
and the README row. Rate-limit keying is always the peer address; no
client-supplied IP header is ever trusted. Tests updated to assert headers
(CF-Connecting-IP included) never influence clientIP.
clientIP() keyed rate-limit buckets on the rightmost X-Forwarded-For
entry, assuming traefik appends the real client IP. The deployed ingress
does not rewrite XFF, so rotating the header gave a fresh bucket per
request (pentest H1: 8 creates with rotating XFF -> 6x201).
Now the bucket keys on the actual peer address (RemoteAddr) by default;
every client-supplied IP header is ignored. Deployments whose ingress
overwrites a client-IP header can opt in via PALETTE_TRUSTED_IP_HEADER
(e.g. CF-Connecting-IP behind Cloudflare) to restore per-client limits.
Adds tests: rotating XFF no longer resets the bucket; the trusted header
is honored only when explicitly configured.
fen