harden(relay): gate forwarded-IP on trusted proxies, bound queue flush

Rate limiting and the per-IP WebSocket cap trusted X-Forwarded-For and
X-Real-Ip unconditionally. Onion traffic bypasses the reverse proxy, so a
client could set the header itself and slip past every limit. Forwarded
headers are now honoured only from peers inside SEPOT_TRUSTED_PROXIES;
everyone else is keyed by peer address, and onion clients share one bucket.

The queue flush also read the whole backlog into memory at once, and the
certificate authority kept the trust-root private key in the database even
though it is only ever needed offline.

deploy/relay/docker-compose.yml

@@ -22,6 +22,13 @@ services:
       DATABASE_URL: postgres://sepot:${POSTGRES_PASSWORD}@db:5432/sepot_relay
       SEPOT_BIND: 0.0.0.0:8470
       SEPOT_ATTACHMENTS_DIR: /var/lib/sepot/attachments
+      # Sítě reverzní proxy, které smí určovat klientskou IP. Forwarded
+      # hlavičky (X-Forwarded-For/X-Real-Ip) se uznají JEN od IP v této sadě,
+      # jinak platí adresa protistrany — jinak by si anti-abuse klíč mohl
+      # nastavit sám klient. Musí pokrýt síť, ze které proxy na relay doráží.
+      # Síť Toru sem NEPATŘÍ: onion klienti mají sdílet jeden bucket.
+      # Prázdné = fail-safe, vždy adresa protistrany.
+      SEPOT_TRUSTED_PROXIES: ${SEPOT_TRUSTED_PROXIES:-}
       # FCM fast mode (opt-in budíčky přes Google) — SA key ŽIJE JEN NA
       # serveru (fcm-sa.json vedle .env, chmod 600, NIKDY do gitu)
       SEPOT_FCM_CREDENTIALS: /etc/sepot/fcm-sa.json