Let the login throttle see real client IPs behind Cloudflare

Behind a proxy REMOTE_ADDR is the proxy, so the per-IP limit would lump
every visitor together. New optional CLIENT_IP_HEADER in config.php
(e.g. 'CF-Connecting-IP') tells the throttle which header carries the
real address; invalid or absent values fall back to REMOTE_ADDR, and
configs that predate the setting behave as before. Only for origins
unreachable except through the proxy — documented in the README, which
also covers the mod_remoteip/real_ip alternative.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SePf61iazhCLJBefdRLBDm

api/auth.php

@@ -27,7 +27,7 @@ verifyCsrfApi($data);
 $action   = $data['action'] ?? '';
 $username = trim($data['username'] ?? '');
 $password = $data['password'] ?? '';
-$ip       = $_SERVER['REMOTE_ADDR'] ?? '';
+$ip       = clientIp();
 
 switch ($action) {
     case 'login':