Fix rate limiter IP spoofing and memory growth

[BrandonS7]

What this does

1. Fix X-Forwarded-For trust

The rate limiter directly trusted the X-Forwarded-For header for client IP identification. Any client can spoof this header to bypass rate limiting entirely by sending a different IP on each request.

Now defaults to request.client.host (the actual TCP connection IP). Only uses X-Forwarded-For if TRUST_PROXY=true is explicitly set - which should only be enabled when running behind a known reverse proxy.

Same fix applied to backend/utils/__init__.py and backend/utils/request.py which had the same pattern.

2. Stale entry cleanup

The in-memory rate limiter dicts grew without bound since entries were never removed. Added periodic cleanup that purges entries older than the rate limit window.

---

No new dependencies. Backward compatible (defaults to safer behavior).