harden(relay): gate forwarded-IP on trusted proxies, bound queue flush

Rate limiting and the per-IP WebSocket cap trusted X-Forwarded-For and
X-Real-Ip unconditionally. Onion traffic bypasses the reverse proxy, so a
client could set the header itself and slip past every limit. Forwarded
headers are now honoured only from peers inside SEPOT_TRUSTED_PROXIES;
everyone else is keyed by peer address, and onion clients share one bucket.

The queue flush also read the whole backlog into memory at once, and the
certificate authority kept the trust-root private key in the database even
though it is only ever needed offline.

rust/Cargo.lock

@@ -2456,6 +2456,7 @@ dependencies = [
  "dashmap",
  "futures-util",
  "hex",
+ "ipnet",
  "jsonwebtoken",
  "libsignal-core",
  "libsignal-protocol",