fix(antispam): harden spam guard with signed form tokens and proxy-safe IP extraction

- Rate limit now uses the last X-Forwarded-For hop (appended by Traefik)
  instead of the client-controlled first hop, which bots rotated freely
- Time-trap anchored to server time via HMAC-signed form token
  (FORM_TOKEN_SECRET) instead of client-supplied form_loaded_at
- Fix RequestQuoteForm regression: FormData was built from scratch without
  honeypot/token hidden inputs and inputs lacked name attributes, so every
  legitimate quote request was silently blocked as spam

.env.example

@@ -53,6 +53,9 @@ GATEKEEPER_PASSWORD=klz2026
 # Required for the Payload CMS AI Chat Agent
 MISTRAL_API_KEY=
 
+# Secret used to sign contact-form anti-spam tokens (server-anchored time-trap)
+FORM_TOKEN_SECRET=
+
 # ────────────────────────────────────────────────────────────────────────────
 # Payload Infrastructure (Dockerized)
 # ────────────────────────────────────────────────────────────────────────────