feat(09-01): arena-proxy survives SSE, client-IP forwarding, upstream-down

- Forward client IP via x-forwarded-for/x-real-ip so the canonical arena's
  per-IP rate limiting isn't collapsed to one bucket per node.
- 30s AbortSignal.timeout on non-stream requests; SSE fight streams
  (/api/fights/:id/stream) are exempt (long-lived by design).
- On upstream fetch failure, log and return 502 {error} instead of a
  buffered hang or a 500 stack trace.
- fights.ts: set X-Accel-Buffering: no on the SSE stream response so an
  nginx-fronted arena (nginx-proxy-manager) doesn't buffer live fight events.
- docker-compose.yml: document ARENA_UPSTREAM_URL / TRUSTED_PROXY (commented,
  no active value set here — the canonical arena gets its own compose file
  in a later plan).

TDD: added the SSE/XFF/502 tests, confirmed the 502 test failed against the
prior implementation, then implemented to green (9/9 arena-proxy tests,
17/17 combined with rate-limit.test.ts).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docker-compose.yml

@@ -35,6 +35,19 @@ services:
       - BOTFIGHTS_CREATOR_PUBKEYS=${BOTFIGHTS_CREATOR_PUBKEYS:-da5e0c1b646bdb13c2300f805b0ca3e5afe5b052c594ce78bac8978d21c3fa39}
       # SQLite database path (defaults to /app/server/data/botfights.db)
       # - DB_PATH=/app/server/data/botfights.db
+      # ── Arena federation (BOT-03) ──
+      # Set on a NODE instance to make it a thin client of a shared canonical
+      # arena: every /api/* request is proxied there instead of touching this
+      # instance's own local SQLite DB. Leave UNSET on the canonical arena
+      # itself (it stays standalone). Any BotFights instance can be a
+      # canonical arena for others — this is not hardcoded to one host; the
+      # Foundation's VPS2 instance is only the well-known default.
+      # - ARENA_UPSTREAM_URL=http://146.59.87.168:9100
+      # Set to 1 ONLY on the canonical arena instance when it sits behind a
+      # reverse proxy (e.g. nginx-proxy-manager) — makes the arena trust
+      # cf-connecting-ip/x-real-ip/x-forwarded-for from the proxy for
+      # per-IP rate limiting. Never set on a node's own proxying instance.
+      # - TRUSTED_PROXY=1
 
 volumes:
   botfights-data: