[medium] Rate limiter is one global bucket #486

Severity: medium

• Body: code reads remoteAddress, srvx exposes request.ip, so every client is 'local': login allows 5 attempts per minute in total (anyone locks everyone out), files POST 30/min shared; with TRUST_PROXY=1 the leftmost X-Forwarded-For is trusted.
• Evidence: src/server/rate-limit.ts:89-104; auth-middleware.ts:285-300; auth.ts:37.

Source: docs/overnight-2026-10-26/round2/issues-draft-2.md § HS7
Filed from the 2026-10-26 overnight audit (read-only findings, not yet triaged).