fix(security): authorize site uploads and harden tokens, media and request identity

src/proxy.ts

@@ -31,12 +31,8 @@ export const proxy = async (req: import("next/server").NextRequest) => {
 	headers.set("x-pathname", req.nextUrl.pathname);
 	headers.set("x-nonce", nonce);
 
-	const ip =
-		req.headers.get("cf-connecting-ip") ??
-		req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ??
-		req.headers.get("x-real-ip") ??
-		"";
-	if (ip) headers.set("x-real-client-ip", ip);
+	// A client may supply this legacy derived header; no consumer should trust it.
+	headers.delete("x-real-client-ip");
 
 	const response = NextResponse.next({ request: { headers } });