trusted proxy, TOTP replay protection, new tests

- Trusted proxy config option for proxy-aware IP extraction
  used by rate limiting and audit logs; validates proxy IP
  before trusting X-Forwarded-For / X-Real-IP headers
- TOTP replay protection via counter-based validation to
  reject reused codes within the same time step (±30s)
- RateLimit middleware updated to extract client IP from
  proxy headers without IP spoofing risk
- New tests for ClientIP proxy logic (spoofed headers,
  fallback) and extended rate-limit proxy coverage
- HTMX error banner script integrated into web UI base
- .gitignore updated for mciasdb build artifact

Security: resolves CRIT-01 (TOTP replay attack) and
DEF-03 (proxy-unaware rate limiting); gRPC TOTP
enrollment aligned with REST via StorePendingTOTP

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cmd/mciasdb/mciasdb_test.go

@@ -206,12 +206,12 @@ func TestRoleRevoke(t *testing.T) {
 		t.Fatalf("create account: %v", err)
 	}
 
-	if err := tool.db.GrantRole(a.ID, "editor", nil); err != nil {
+	if err := tool.db.GrantRole(a.ID, "user", nil); err != nil {
 		t.Fatalf("grant role: %v", err)
 	}
 
 	captureStdout(t, func() {
-		tool.roleRevoke([]string{"--id", a.UUID, "--role", "editor"})
+		tool.roleRevoke([]string{"--id", a.UUID, "--role", "user"})
 	})
 
 	roles, err := tool.db.GetRoles(a.ID)