fix: address final review findings

apps/nextjs/src/app/api/backup/test/import-route.spec.ts

@@ -101,7 +101,7 @@ describe("POST /api/backup/import", () => {
   let activeDatabasePath: string;
 
   beforeEach(() => {
-    vi.useFakeTimers();
+    vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout"] });
     temporaryDirectory = fs.mkdtempSync(path.join(os.tmpdir(), "homarr-import-route-test-"));
     activeDatabasePath = path.join(temporaryDirectory, "db.sqlite");
     routeMocks.dbEnv.DRIVER = "better-sqlite3";

packages/common/src/request.ts

@@ -11,5 +11,11 @@ export const userAgent = (headers: Headers) => {
 export type DeviceType = "console" | "mobile" | "tablet" | "smarttv" | "wearable" | "embedded" | undefined;
 
 export const ipAddressFromHeaders = (headers: Headers): string | null => {
-  return headers.get("x-forwarded-for");
+  const forwardedFor = headers.get("x-forwarded-for");
+  if (!forwardedFor) return null;
+
+  // The bundled nginx proxy appends the transport peer to this chain. Using
+  // the last hop prevents a caller-controlled prefix from creating arbitrary
+  // rate-limit identities.
+  return forwardedFor.split(",").at(-1)?.trim() || null;
 };