fix: add trust proxy for Cloudflare — fixes ERR_ERL_UNEXPECTED_X_FORWARDED_FOR in rate limiter

packages/api/src/index.ts

@@ -16,6 +16,9 @@ import { blogRouter } from "./routes/blog";
 
 const app = express();
 
+// Trust Cloudflare proxy (required for express-rate-limit with X-Forwarded-For)
+app.set("trust proxy", 1);
+
 // Middleware
 app.use(helmet({ contentSecurityPolicy: false }));
 app.use(cors());