fix: add input validation, Zod schemas, rate limiting, and IP trust

- Add Zod schema for webhook response parsing (orchestrator.ts)
- Add Zod schemas for POST /respond and /react request bodies
- Add safe integer validation for batch count param
- Prefer cf-connecting-ip over spoofable x-forwarded-for
- Add ID format validation on URL params
- Add rate limiting on /auth/login (30/min) and /update (10/min)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/middleware/rate-limit.ts

@@ -24,9 +24,11 @@ export function rateLimit(windowMs: number, maxHits: number) {
   return async (c: Context, next: Next) => {
     if (isDev) return next()
 
-    // Extract real IP — handle comma-separated x-forwarded-for (first = client)
-    const xff = c.req.header('x-forwarded-for')
-    const realIp = xff ? xff.split(',')[0].trim() : c.req.header('cf-connecting-ip') || c.req.header('x-real-ip') || 'unknown'
+    // Extract real IP — prefer trusted proxy headers over spoofable x-forwarded-for
+    const realIp = c.req.header('cf-connecting-ip')
+      || c.req.header('x-real-ip')
+      || c.req.header('x-forwarded-for')?.split(',')[0].trim()
+      || 'unknown'
     const key = realIp
     const now = Date.now()
     const entry = hitCounts.get(key)