fix(antispam): harden spam guard with signed form tokens and proxy-safe IP extraction

- Rate limit now uses the last X-Forwarded-For hop (appended by Traefik)
  instead of the client-controlled first hop, which bots rotated freely
- Time-trap anchored to server time via HMAC-signed form token
  (FORM_TOKEN_SECRET) instead of client-supplied form_loaded_at
- Fix RequestQuoteForm regression: FormData was built from scratch without
  honeypot/token hidden inputs and inputs lacked name attributes, so every
  legitimate quote request was silently blocked as spam

components/forms/ContactForm.tsx

@@ -3,11 +3,22 @@
 import * as React from 'react';
 import { m } from 'framer-motion';
 import { Button } from '@/components/ui/Button';
-import { sendContactFormAction } from '@/app/actions/contact';
+import { sendContactFormAction, issueFormTokenAction } from '@/app/actions/contact';
 
 export function ContactForm() {
   const [status, setStatus] = React.useState<'idle' | 'loading' | 'success' | 'error'>('idle');
-  const [formLoadedAt] = React.useState(() => Date.now());
+  const [formToken, setFormToken] = React.useState<string | null>(null);
+
+  // Server-signed anti-spam token: proves the submission comes from a real page load
+  React.useEffect(() => {
+    let cancelled = false;
+    issueFormTokenAction().then((token) => {
+      if (!cancelled) setFormToken(token);
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, []);
 
   const handleSubmit = async (e: React.FormEvent<HTMLFormElement>) => {
     e.preventDefault();
@@ -133,7 +144,7 @@ export function ContactForm() {
           </div>
 
           <input type="text" name="company_website" style={{ display: 'none' }} tabIndex={-1} autoComplete="off" />
-          <input type="hidden" name="form_loaded_at" value={formLoadedAt} />
+          <input type="hidden" name="form_token" value={formToken ?? ''} />
 
           <Button 
             type="submit"