feat(security): Cloudflare-aware IP trust and admin-tunable anti-DDoS

- resolveClientIp: trust cf-connecting-ip only behind cf-ray/cdn-loop, use nginx x-real-ip otherwise (anti-spoof)
- antiddos-config: Redis-backed live config (antiddos:config) with 30s cache, 13 ANTI_DDOS_* env vars
- ddos-guard: consume tunable rates/tiers via getAntiddosConfig
- admin panel at /admin/devops/antiddos (save/reset/unban actions, PERMS.SETTINGS_VIEW)
- register new admin page in housekeeping migration matrix (146 -> 147)

src/app/admin/devops/page.tsx

@@ -71,6 +71,9 @@ export default async function DevOpsPage() {
 			<Link href="/admin/devops/deliveries" className="btn btn-outline">
 				{deliveries("title")}
 			</Link>
+			<Link href="/admin/devops/antiddos" className="btn btn-outline">
+				Anti-DDoS protection
+			</Link>
 			{/* Status cards */}
 			<div className="grid gap-4 md:grid-cols-2 lg:grid-cols-5">
 				<Card>