fix(auth): real client IP rate-limiting + remote default-password guard

- Add custom-server.js: inject unspoofable socket IP, strip client XFF
  (wired into Docker CMD + CLI spawn + build-cli copy)
- loginLimiter: key on trusted x-9r-real-ip, TRUST_PROXY opt-in, global fallback
- Force password change on first remote login while default is in use
- Add /api/auth/reset-password (local-only) so CLI reset writes live SQLite
- CLI settings: reset via API instead of stale db.json
- Fix OAuth modals opening duplicate browser tabs on add-connection
- Add cli:pack / cli:publish scripts

Co-authored-by: Cursor <cursoragent@cursor.com>

custom-server.js

@@ -0,0 +1,22 @@
+const http = require("http");
+
+const origCreate = http.createServer.bind(http);
+
+// Wrap Next standalone HTTP server: derive client IP from the TCP socket
+// (unspoofable) and strip client-supplied forwarding headers so downstream
+// rate-limiting keys on the real peer address instead of attacker-controlled XFF.
+http.createServer = (...args) => {
+  const handler = args.find((a) => typeof a === "function");
+  const rest = args.filter((a) => typeof a !== "function");
+  if (!handler) return origCreate(...args);
+  const wrapped = (req, res) => {
+    const ip = req.socket && req.socket.remoteAddress ? req.socket.remoteAddress : "";
+    delete req.headers["x-9r-real-ip"];
+    delete req.headers["x-forwarded-for"];
+    req.headers["x-9r-real-ip"] = ip;
+    return handler(req, res);
+  };
+  return origCreate(...rest, wrapped);
+};
+
+require("./server.js");