Fix input handling and IP detection for public deploy

- Reject usernames with path-traversal characters before building the
  Depop API URL
- Catch requests.exceptions.InvalidHeader (raised on CRLF in a pasted
  cookie) without letting its message - which embeds the raw cookie
  value - reach the rendered error page
- Rate-limit by Cloudflare's CF-Connecting-IP (Render fronts every app
  with Cloudflare) instead of the ProxyFix-derived remote_addr, which
  was resolving to Cloudflare's edge IP for every visitor

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>