feat(proxy): sync Cloudflare ranges at nginx+Traefik, block IP spoofing

- cloudflare-ips.conf (new): geo $cms_trusted_edge + set_real_ip_from from
  live CF IPv4/IPv6 ranges plus Traefik bridge and loopback
- nginx-cms.conf: forward real client IP only from trusted peers, strip
  incoming CF-Connecting-IP, 403 any other peer that presents one
  (spoof gate); direct game clients on :9443 stay unaffected
- cf-ips-sync.sh (new): fetch cloudflare.com/ips-v4/-v6, regenerate the
  nginx snippet and Traefik websecure.forwardedHeaders.trustedIPs
- nginx-sync.sh: install the cloudflare-ips.conf snippet
- cms_upstream_servers.conf: point default at the live green slot 3003

deployment/proxy/cms_upstream_servers.conf

@@ -1,2 +1,2 @@
 # Default; ci-deploy.sh (blue/green) herschrijft dit bestand bij elke switch.
-server 127.0.0.1:3002;
+server 127.0.0.1:3003;