fix(antispam): harden spam guard with signed form tokens and proxy-safe IP extraction

- Rate limit now uses the last X-Forwarded-For hop (appended by Traefik)
  instead of the client-controlled first hop, which bots rotated freely
- Time-trap anchored to server time via HMAC-signed form token
  (FORM_TOKEN_SECRET) instead of client-supplied form_loaded_at
- Fix RequestQuoteForm regression: FormData was built from scratch without
  honeypot/token hidden inputs and inputs lacked name attributes, so every
  legitimate quote request was silently blocked as spam

lib/antispam/client-ip.ts

@@ -0,0 +1,18 @@
+/**
+ * Extracts the client IP from the X-Forwarded-For header.
+ *
+ * Our edge proxy (Traefik) APPENDS the real peer IP to any client-supplied
+ * chain, so the LAST hop is the only trustworthy entry. The first hop is
+ * attacker-controlled: reading it lets bots rotate fake IPs per request and
+ * defeat IP-based rate limiting entirely.
+ */
+export function parseClientIp(xForwardedFor: string | null | undefined): string | null {
+  if (!xForwardedFor) {
+    return null;
+  }
+  const hops = xForwardedFor
+    .split(',')
+    .map((hop) => hop.trim())
+    .filter(Boolean);
+  return hops.length > 0 ? hops[hops.length - 1] : null;
+}