feat: v5 — boxing poster fight cards, 12-char names, diverse mock bots

- Fight Card page: dramatic poster background with cross-hatch, spotlights,
  vignettes, corner brackets, scan lines; 3D VS orb with punch animation;
  selectable undercard with main event always pinned at top
- PosterSprite: high-quality 480px poster frame with 6-pass renderer
  (aura, glow, bevel, specular, particles); PixelGlove component
- 12-char bot name limit across all forms and server validation
- Mock bots: all 100 now have diverse archetypes (25 types), 25% human
  fighters; seedMockBots updates existing bots on restart
- Leaderboard: inline SpritePreview next to each bot name
- Nostr auth: persistent login, nsec copy button
- Wallet: NWC + Lightning Address, ranked fight flow
- Server: payments, ranked queue, customization endpoint

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/middleware/rate-limit.ts

@@ -16,7 +16,10 @@ export function rateLimit(windowMs: number, maxHits: number) {
   return async (c: Context, next: Next) => {
     if (isDev) return next()
 
-    const key = c.req.header('x-forwarded-for') || c.req.header('cf-connecting-ip') || 'unknown'
+    // Extract real IP — handle comma-separated x-forwarded-for (first = client)
+    const xff = c.req.header('x-forwarded-for')
+    const realIp = xff ? xff.split(',')[0].trim() : c.req.header('cf-connecting-ip') || c.req.header('x-real-ip') || 'unknown'
+    const key = realIp
     const now = Date.now()
     const entry = hitCounts.get(key)