fix: cap admin sign-in attempts across all clients (GHSA-7pj2-232x-6698)

The admin login limit keys on the client IP taken from
X-Forwarded-For. With no reverse proxy in front, that header is
whatever the client sends (Next only fills it from the socket when the
request carries none), so each forged address got a fresh bucket of
five guesses. Route handlers cannot see the socket address, so the
limiter now also stops at 50 attempts per 15 minutes across all
clients. `.env.example` says why a proxy that appends the header is
still needed for trustworthy per-IP limits and audit addresses.

.env.example

@@ -370,6 +370,10 @@ LOGIN_WEBSITE_URL=https://bulwarkmail.org
 # How many trusted reverse proxies sit in front of the app. The client IP is
 # taken that many entries from the right of X-Forwarded-For, so an attacker
 # can't spoof it by prepending values. Default: 1.
+# Without any reverse proxy the header is whatever the client sends, so
+# per-IP limits and audit-log addresses can be forged; admin sign-in then
+# still stops at 50 attempts per 15 minutes across all clients. Put the
+# app behind a proxy that appends X-Forwarded-For.
 # TRUSTED_PROXY_DEPTH=2
 
 # Allow search engines to index the app (robots.txt / noindex). Default: false.