feat(proxy): sync Cloudflare ranges at nginx+Traefik, block IP spoofing

- cloudflare-ips.conf (new): geo $cms_trusted_edge + set_real_ip_from from
  live CF IPv4/IPv6 ranges plus Traefik bridge and loopback
- nginx-cms.conf: forward real client IP only from trusted peers, strip
  incoming CF-Connecting-IP, 403 any other peer that presents one
  (spoof gate); direct game clients on :9443 stay unaffected
- cf-ips-sync.sh (new): fetch cloudflare.com/ips-v4/-v6, regenerate the
  nginx snippet and Traefik websecure.forwardedHeaders.trustedIPs
- nginx-sync.sh: install the cloudflare-ips.conf snippet
- cms_upstream_servers.conf: point default at the live green slot 3003

scripts/nginx-sync.sh

@@ -16,6 +16,7 @@
 #   nginx.conf                                -> /etc/nginx/nginx.conf
 #   nginx-mime.types                          -> /etc/nginx/mime.types
 #   nginx-cms.conf                            -> /etc/nginx/sites-available/cms.conf
+#   cloudflare-ips.conf                       -> /etc/nginx/conf.d/cloudflare-ips.conf
 #   cms_upstream_servers.conf                 -> /etc/nginx/snippets/cms_upstream_servers.conf
 #   symlink sites-enabled/cms.conf            -> ../sites-available/cms.conf
 set -euo pipefail
@@ -66,6 +67,7 @@ changed=0
 if install_file "$PROXY_DIR/nginx.conf" "$NGINX_DIR/nginx.conf"; then changed=1; fi
 if install_file "$PROXY_DIR/nginx-mime.types" "$NGINX_DIR/mime.types"; then changed=1; fi
 if install_file "$PROXY_DIR/nginx-cms.conf" "$NGINX_DIR/sites-available/cms.conf"; then changed=1; fi
+if install_file "$PROXY_DIR/cloudflare-ips.conf" "$NGINX_DIR/conf.d/cloudflare-ips.conf"; then changed=1; fi
 if install_file "$PROXY_DIR/cms_upstream_servers.conf" "$NGINX_DIR/snippets/cms_upstream_servers.conf"; then changed=1; fi
 
 if [[ ! -f "$NGINX_DIR/sites-enabled/cms.conf" ]]; then