fix: Forward real client IP through Docker proxy

- Update setupProxy.js to forward X-Real-IP and X-Forwarded-For headers
- Improve IP detection in backend middleware to prioritize X-Real-IP
- Add debug logging for IP detection in development mode
- Update .env.example with clearer IP configuration examples
- Enable debug logging in docker-compose.dev.yml

This fixes the issue where Docker network IPs (172.20.x.x) were being
detected instead of the real client IP addresses.

To fix IP restrictions, update your .env file:
ALLOWED_IPS=10.30.30.0/24,<your-other-ips>

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

backend/src/middleware/ipFilter.middleware.js

@@ -13,15 +13,26 @@ const ipFilterMiddleware = (req, res, next) => {
     return next();
   }
 
-  // Get client IP
-  const clientIp = req.ip || 
+  // Get client IP - priority order for headers when behind proxy
+  const clientIp = req.headers['x-real-ip'] ||
+                   req.headers['x-forwarded-for']?.split(',')[0].trim() ||
+                   req.ip || 
                    req.connection.remoteAddress || 
-                   req.socket.remoteAddress ||
-                   req.headers['x-forwarded-for']?.split(',')[0];
+                   req.socket.remoteAddress;
 
   // Normalize IPv6 localhost to IPv4
   const normalizedIp = clientIp === '::1' ? '127.0.0.1' : clientIp;
 
+  // Debug logging in development
+  if (config.app.env === 'development') {
+    logger.debug(`IP Filter Debug - Headers: ${JSON.stringify({
+      'x-real-ip': req.headers['x-real-ip'],
+      'x-forwarded-for': req.headers['x-forwarded-for'],
+      'req.ip': req.ip,
+      'detected': normalizedIp
+    })}`);
+  }
+
   try {
     // Check if IP is in allowed list
     const isAllowed = ipRangeCheck(normalizedIp, config.security.allowedIps);