fix: use last IP from X-Forwarded-For to prevent rate limit bypass

When the server is configured with proxied: true, addressOfRequest()
was returning the first (leftmost) IP from the X-Forwarded-For header.
This value is client-controlled and can be spoofed, allowing attackers
to bypass the login rate limit by rotating the spoofed IP on each
request.

The fix changes the function to use the last (rightmost) IP instead,
which is the one appended by the trusted reverse proxy. This ensures
the rate limiter always sees the real client IP address.

Changes:
- Modified addressOfRequest() to return the last IP in X-Forwarded-For
  with strings.TrimSpace() to handle whitespace
- Added 8 test cases covering: non-proxied mode, missing XFF header,
  single IP, multiple IPs, spoofed first IP, empty XFF, trailing
  comma fallback, and whitespace trimming

Fixes #1031