fix(security): timing attack, rate limiter за прокси, хардкод ID в скриптах (20.09.2026)

main.py

@@ -128,8 +128,16 @@ async def rate_limit_middleware(request: Request, call_next):
     if path in ["/", "/health"]:
         return await call_next(request)
     
+    # 🔧 ФИКС (20.09.2026): за Cloudflare/nginx request.client.host — IP прокси.
+# Берём реальный IP из X-Forwarded-For (первый адрес).
+forwarded = request.headers.get("x-forwarded-for")
+if forwarded:
+    client_ip = forwarded.split(",")[0].strip()
+elif request.headers.get("cf-connecting-ip"):
+    client_ip = request.headers.get("cf-connecting-ip")
+else:
     client_ip = request.client.host if request.client else "unknown"
-    rate_key = f"{client_ip}:{path}"
+rate_key = f"{client_ip}:{path}"
     
     if not rate_limiter.is_allowed(rate_key, path):
         retry_after = rate_limiter.get_retry_after(rate_key, path)