短信发送失败增加冷却防连点限流并配置trust proxy恢复真实客户端IP

apps/backend/src/config/env-overrides.ts

@@ -28,6 +28,7 @@ type EnvOverride = {
 
 export const ENV_OVERRIDES: readonly EnvOverride[] = [
   integerEnv('PORT', ['server', 'port']),
+  trustProxyEnv('HTTP_TRUST_PROXY', ['server', 'trustProxy']),
   stringEnv('DATA_ROOT', ['data', 'root'], path.resolve),
   stringEnv('LOG_LEVEL', ['logging', 'level']),
   stringEnv('LOG_INTEGRATION_LEVEL', ['logging', 'integrationLevel']),
@@ -258,6 +259,31 @@ function booleanEnv(env: string, configPath: RuntimeConfigPath): EnvOverride {
   }
 }
 
+function trustProxyEnv(env: string, configPath: RuntimeConfigPath): EnvOverride {
+  return {
+    env,
+    path: configPath,
+    read: parseTrustProxy,
+  }
+}
+
+/** HTTP_TRUST_PROXY 支持 true/false、反代层数（数字）与 loopback 等预定义子网，其余值回落到默认。 */
+function parseTrustProxy(rawValue: unknown): RuntimeConfigValue | null {
+  const value = parseString(rawValue)
+  if (value === null) return null
+  const normalized = value.trim().toLowerCase()
+  if (normalized === 'true' || normalized === 'yes') return true
+  if (normalized === 'false' || normalized === 'no') return false
+  if (normalized === 'loopback' || normalized === 'uniquelocal' || normalized === 'linklocal') {
+    return normalized
+  }
+  if (/^\d+$/.test(normalized)) {
+    const hops = Number(normalized)
+    return hops >= 0 ? hops : null
+  }
+  return null
+}
+
 function adminUsersJsonEnv(env: string, configPath: RuntimeConfigPath): EnvOverride {
   return {
     env,