fix: secure authentication request identity

Replace Better Auth's default trust of a caller-controlled X-Forwarded-For
with a platform-owned client-address resolution boundary: direct mode (the
safe default) trusts only the real socket peer, and an explicit trusted-proxy
mode requires a header name, a concrete trusted-proxy list, and only honors a
forwarded chain from an actual trusted peer. This closes a rate-limit bypass
where rotating a spoofed header let a caller choose a fresh bucket on every
request. Public sign-up is also disabled by default and requires an explicit
typed opt-in, using Better Auth's own disableSignUp gate so no email-existence
leak or second signup path is introduced.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

core/src/cli/doctor.ts

@@ -39,6 +39,7 @@ function requiredString(value: unknown): string {
 function readIdentityConfigurationFromEnvironment(): DoctorOptions["identityConfiguration"] {
   const secret = process.env.EKKLESIA_IDENTITY_SECRET;
   const baseUrl = process.env.EKKLESIA_IDENTITY_BASE_URL;
+  const publicSignupEnabled = process.env.EKKLESIA_PUBLIC_SIGNUP_ENABLED;
   const trustedOriginsValue = process.env.EKKLESIA_IDENTITY_TRUSTED_ORIGINS;
   const trustedOrigins = trustedOriginsValue
     ? trustedOriginsValue
@@ -50,11 +51,28 @@ function readIdentityConfigurationFromEnvironment(): DoctorOptions["identityConf
   return {
     ...(baseUrl ? { baseUrl } : {}),
     environment: process.env.NODE_ENV === "development" ? "development" : "production",
+    ...(publicSignupEnabled ? { publicSignupEnabled } : {}),
     ...(secret ? { secret } : {}),
     ...(trustedOrigins ? { trustedOrigins } : {}),
   };
 }
 
+function readClientAddressFromEnvironment(): DoctorOptions["clientAddress"] {
+  const mode = process.env.EKKLESIA_CLIENT_ADDRESS_MODE;
+  if (mode === undefined) {
+    return undefined;
+  }
+  const trustedProxiesValue = process.env.EKKLESIA_CLIENT_ADDRESS_TRUSTED_PROXIES;
+  return {
+    header: process.env.EKKLESIA_CLIENT_ADDRESS_HEADER,
+    mode,
+    trustedProxies: trustedProxiesValue
+      ?.split(",")
+      .map((entry) => entry.trim())
+      .filter((entry) => entry.length > 0),
+  };
+}
+
 export async function runDoctorCommand(repositoryRoot = process.cwd()): Promise<number> {
   const [rootValue, moduleSdkValue] = await Promise.all([
     readJson(path.join(repositoryRoot, "package.json")),
@@ -64,6 +82,7 @@ export async function runDoctorCommand(repositoryRoot = process.cwd()): Promise<
   const moduleSdkPackage = rootPackageDocument(moduleSdkValue);
 
   const report = await diagnoseEkklesia({
+    clientAddress: readClientAddressFromEnvironment(),
     databaseUrl: process.env.DATABASE_URL,
     identityConfiguration: readIdentityConfigurationFromEnvironment(),
     moduleDiscovery: {