feat(saas): add trusted_proxies config for reverse proxy rate limiting

- Add trusted_proxies field to ServerConfig (Vec<String>, serde default)
- Default value is empty vector (no proxy trust until explicitly configured)
- Development config: trust localhost IPs (127.0.0.1, ::1)
- Production config: placeholder localhost IPs with comment to replace

crates/zclaw-saas/src/config.rs

@@ -59,6 +59,10 @@ pub struct ServerConfig {
     pub port: u16,
     #[serde(default)]
     pub cors_origins: Vec<String>,
+    /// 可信反向代理 IP 列表。仅对来自这些 IP 的请求解析 X-Forwarded-For 头。
+    /// 生产环境应为 Nginx/Caddy 的实际 IP，如 ["127.0.0.1", "10.0.0.1"]
+    #[serde(default)]
+    pub trusted_proxies: Vec<String>,
 }
 
 /// 数据库配置
@@ -151,6 +155,7 @@ impl Default for ServerConfig {
             host: default_host(),
             port: default_port(),
             cors_origins: Vec::new(),
+            trusted_proxies: vec![],
         }
     }
 }