fix: validate proxy IP headers and force attachment for unsafe MIME types (BUG-112, BUG-118)

BUG-112: clientIPWithProxies now validates extracted X-Real-IP and
X-Forwarded-For values with net.ParseIP. Non-IP strings are rejected,
falling back to RemoteAddr. Prevents attackers from choosing arbitrary
rate-limit bucket keys via header injection.

BUG-118: Files with MIME types that could execute active content
(HTML, SVG, XML, PDF) are now served with Content-Disposition: attachment
instead of inline, preventing content hosting under the OwnCord origin.

Server/api/middleware.go

@@ -211,15 +211,20 @@ func clientIPWithProxies(r *http.Request, trustedCIDRs []string) string {
 	}
 
 	// Prefer X-Real-IP when coming from a trusted proxy.
+	// BUG-112: Validate extracted IP to prevent spoofed rate-limit keys.
 	if xri := strings.TrimSpace(r.Header.Get("X-Real-IP")); xri != "" {
-		return xri
+		if net.ParseIP(xri) != nil {
+			return xri
+		}
 	}
 
 	// Fall back to the leftmost (client) entry in X-Forwarded-For.
 	if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
 		parts := strings.SplitN(xff, ",", 2)
 		if client := strings.TrimSpace(parts[0]); client != "" {
-			return client
+			if net.ParseIP(client) != nil {
+				return client
+			}
 		}
 	}