Let the login throttle see real client IPs behind Cloudflare

Behind a proxy REMOTE_ADDR is the proxy, so the per-IP limit would lump
every visitor together. New optional CLIENT_IP_HEADER in config.php
(e.g. 'CF-Connecting-IP') tells the throttle which header carries the
real address; invalid or absent values fall back to REMOTE_ADDR, and
configs that predate the setting behave as before. Only for origins
unreachable except through the proxy — documented in the README, which
also covers the mod_remoteip/real_ip alternative.

Claude-Session: https://claude.ai/code/session_01SePf61iazhCLJBefdRLBDm

config.example.php

@@ -19,6 +19,14 @@ define('COMPLETE_THRESHOLD', 0.95);
 // Allow new users to self-register from the login page.
 define('ALLOW_REGISTRATION', true);
 
+// Only when the app sits behind a proxy that hides the visitor's address
+// (Cloudflare): the header carrying the real client IP, used by the login
+// brute-force throttle. Set this ONLY if the origin cannot be reached except
+// through that proxy — a directly reachable origin lets anyone spoof the
+// header and dodge the per-IP limit. Leave '' to use the connection address.
+//   define('CLIENT_IP_HEADER', 'CF-Connecting-IP');
+define('CLIENT_IP_HEADER', '');
+
 // Return the exception type, file:line and stack trace in API error responses.
 // Errors are written to the PHP error log either way — this only controls what
 // the browser is told, so leave it false on anything publicly reachable.