fix(security): drop URLhaus feed, validate CIDR ranges, pass unknown client IPs

src/lib/ddos-guard.ts

@@ -4,7 +4,7 @@ import type { NextRequest } from "next/server";
 import { NextResponse } from "next/server";
 import { env } from "@/env";
 import { getAntiddosConfig } from "@/lib/antiddos-config";
-import { resolveClientIp } from "@/lib/client-ip";
+import { resolveClientIp, UNKNOWN_CLIENT_IP } from "@/lib/client-ip";
 import { isCloudflareProxied } from "@/lib/cloudflare";
 import { maybeAutoBlockCloudflare } from "@/lib/cloudflare-api";
 import { maybeAutoBlockCrowdsec } from "@/lib/crowdsec-api";
@@ -71,6 +71,12 @@ export async function enforceDdosRateLimit(
 	}
 
 	const ip = resolveClientIp(req.headers);
+	// A trusted ingress always resolves a real client address. `0.0.0.0` is the
+	// sentinel for header-less loopback traffic (health checks, CI browser
+	// gates, monitoring). If it were rate-limited or blocked it would occupy a
+	// single shared key, and any burst of synthetic local traffic could then
+	// shed all origin-verified requests — exactly what broke CI smoke tests.
+	if (ip === UNKNOWN_CLIENT_IP) return { outcome: "pass" };
 	const blockKey = `antiddos:block:${ip}`;
 	if (redis) {
 		try {