- Rate limit now uses the last X-Forwarded-For hop (appended by Traefik)
instead of the client-controlled first hop, which bots rotated freely
- Time-trap anchored to server time via HMAC-signed form token
(FORM_TOKEN_SECRET) instead of client-supplied form_loaded_at
- Fix RequestQuoteForm regression: FormData was built from scratch without
honeypot/token hidden inputs and inputs lacked name attributes, so every
legitimate quote request was silently blocked as spam
