trusted proxy, TOTP replay protection, new tests

- Trusted proxy config option for proxy-aware IP extraction
  used by rate limiting and audit logs; validates proxy IP
  before trusting X-Forwarded-For / X-Real-IP headers
- TOTP replay protection via counter-based validation to
  reject reused codes within the same time step (±30s)
- RateLimit middleware updated to extract client IP from
  proxy headers without IP spoofing risk
- New tests for ClientIP proxy logic (spoofed headers,
  fallback) and extended rate-limit proxy coverage
- HTMX error banner script integrated into web UI base
- .gitignore updated for mciasdb build artifact

Security: resolves CRIT-01 (TOTP replay attack) and
DEF-03 (proxy-unaware rate limiting); gRPC TOTP
enrollment aligned with REST via StorePendingTOTP

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/ui/handlers_auth.go

@@ -149,7 +149,7 @@ func (u *UIServer) handleTOTPStep(w http.ResponseWriter, r *http.Request) {
 		u.render(w, "login", LoginData{Error: "internal error"})
 		return
 	}
-	valid, err := auth.ValidateTOTP(secret, totpCode)
+	valid, totpCounter, err := auth.ValidateTOTP(secret, totpCode)
 	if err != nil || !valid {
 		u.writeAudit(r, model.EventLoginTOTPFail, &acct.ID, nil, `{"reason":"wrong_totp"}`)
 		_ = u.db.RecordLoginFailure(acct.ID)
@@ -166,6 +166,23 @@ func (u *UIServer) handleTOTPStep(w http.ResponseWriter, r *http.Request) {
 		})
 		return
 	}
+	// Security (CRIT-01): reject replay of a code already used within its
+	// ±30-second validity window.
+	if err := u.db.CheckAndUpdateTOTPCounter(acct.ID, totpCounter); err != nil {
+		u.writeAudit(r, model.EventLoginTOTPFail, &acct.ID, nil, `{"reason":"totp_replay"}`)
+		_ = u.db.RecordLoginFailure(acct.ID)
+		newNonce, nonceErr := u.issueTOTPNonce(acct.ID)
+		if nonceErr != nil {
+			u.render(w, "login", LoginData{Error: "internal error"})
+			return
+		}
+		u.render(w, "totp_step", LoginData{
+			Error:    "invalid TOTP code",
+			Username: username,
+			Nonce:    newNonce,
+		})
+		return
+	}
 
 	u.finishLogin(w, r, acct)
 }
@@ -251,7 +268,7 @@ func (u *UIServer) handleLogout(w http.ResponseWriter, r *http.Request) {
 
 // writeAudit is a fire-and-forget audit log helper for the UI package.
 func (u *UIServer) writeAudit(r *http.Request, eventType string, actorID, targetID *int64, details string) {
-	ip := clientIP(r)
+	ip := u.clientIP(r)
 	if err := u.db.WriteAuditEvent(eventType, actorID, targetID, ip, details); err != nil {
 		u.logger.Warn("write audit event", "type", eventType, "error", err)
 	}