Trust proxy headers by hop count, and log every credential event

Operator, before exposing the instance: *"I'd expect that we should have a proxy
hops setting for how many proxy hops we should trust a shared real-ip at… and is
there any session logging."* Neither existed, and the first one was a real hole.

**The address was forgeable.** `client_address()` read the LEFTMOST
`X-Forwarded-For` entry — nominally "the original client", and precisely the one a
caller controls, because anything they send arrives before what proxies append. So
`curl -H "X-Forwarded-For: 1.2.3.4"`, rotated per request, minted a fresh
rate-limit bucket every time.

Concretely: stuffing ONE account stayed limited (the account key is unforgeable
and that is why it exists), but spraying MANY accounts from one source was not —
each account got its own budget, and the per-address cap meant to bound the total
was defeated by a header. On a LAN that is nothing. It is not nothing on a public
host.

Now it counts in from the RIGHT by `THOUGHTSYNC_TRUSTED_PROXY_HOPS`, default 1.
Each hop appends what it saw, so the rightmost entries are the ones our own
infrastructure wrote and a forged prefix lands to the left of them where it can
never be selected — proven for the honest, forged, padded, CDN and
shorter-than-configured cases. 0 ignores the header entirely; 2 is Cloudflare in
front of a proxy. Too high is the dangerous direction, so a header shorter than
configured falls back to the socket address rather than reaching further left.

`X-Forwarded-Proto` had the same bug and now shares the same rule. Both live in a
new `proxy.py` rather than being written twice — two places holding one decision
is how issue 2183 happened, and this is the same decision.

Env rather than the Settings UI, against rule 25's usual pull: it is deployment
topology rather than preference, and the limiter consults it BEFORE opening a
database connection, which is the entire point of checking a throttle before doing
expensive work. Easy to move if that reads wrong.

**And there was no logging at all** — `auth.py` had no logger, and the only record
of anything was `device_tokens.last_used_at`. Sign-ins, failures, throttle trips,
new accounts and device-token issuance now all log, with the attempted email and
the trusted address. Deliberately including the email: it is the operator's own
server, and "somebody failed a login" without saying against which account is not
actionable.

`basicConfig` at INFO in `create_app`, because hypercorn configures its own loggers
and leaves the root at WARNING — without it every line above would have gone
nowhere, which is a worse failure than not writing them.

This is the app log, not an audit table. Not queryable, not retained past log
rotation. The table is task 2939; this is what makes the next few days observable.

tests/test_ratelimit.py

@@ -128,21 +128,10 @@ async def test_register_is_throttled_by_address(app):
     resp = await client.post(
         "/api/auth/register",
         json={"email": "new@example.com", "password": "a-long-enough-password"},
+        # One entry, so with the default single trusted hop this IS the address the
+        # limiter keys on. The forged-prefix cases live in test_proxy.py.
         headers={"X-Forwarded-For": "203.0.113.9"},
     )
     assert resp.status_code == 429
 
 
-async def test_client_address_prefers_the_forwarded_client(app):
-    # Behind a reverse proxy, remote_addr is the PROXY for every request on earth —
-    # keying on it would rate-limit the entire internet as one caller. The leftmost
-    # X-Forwarded-For entry is the original client.
-    async with app.test_request_context("/", headers={"X-Forwarded-For": "198.51.100.4, 10.0.0.1"}):
-        assert ratelimit.client_address() == "198.51.100.4"
-
-
-async def test_client_address_falls_back_to_the_peer(app):
-    async with app.test_request_context("/"):
-        # No proxy header: whatever the peer address is, it must be a usable key
-        # rather than an empty string sharing one bucket with everyone.
-        assert ratelimit.client_address()