fix: set trust proxy to 2 for Cloudflare + nginx chain (#507)

express-rate-limit v8.4+ rejects `trust proxy = true` because it allows
anyone to spoof X-Forwarded-For and bypass rate limiting
(ERR_ERL_PERMISSIVE_TRUST_PROXY). Setting it to 2 trusts exactly the two
known proxy hops (Cloudflare → nginx → Express) while still resolving
the correct client IP for logging and rate limiting.

Author: marcoscaceres

app.ts

@@ -21,7 +21,7 @@ const app = express();
 app.use(compression());
 
 // logging
-app.enable("trust proxy"); // for :remote-addr
+app.set("trust proxy", 2); // Cloudflare → nginx → Express
 app.use(logging.stdout());
 app.use(logging.stderr());