fix: address final review findings

packages/common/src/request.ts

@@ -11,5 +11,11 @@ export const userAgent = (headers: Headers) => {
 export type DeviceType = "console" | "mobile" | "tablet" | "smarttv" | "wearable" | "embedded" | undefined;
 
 export const ipAddressFromHeaders = (headers: Headers): string | null => {
-  return headers.get("x-forwarded-for");
+  const forwardedFor = headers.get("x-forwarded-for");
+  if (!forwardedFor) return null;
+
+  // The bundled nginx proxy appends the transport peer to this chain. Using
+  // the last hop prevents a caller-controlled prefix from creating arbitrary
+  // rate-limit identities.
+  return forwardedFor.split(",").at(-1)?.trim() || null;
 };