Fix internal nginx config

frontend/nginx.conf.example

@@ -27,16 +27,17 @@ server {
     # Reverse proxy the API to the Go service. Keeping the same origin means
     # the session cookie (SameSite=Lax) and CSRF cookie work without CORS.
     #
-    # X-Forwarded-For uses $remote_addr (the immediate peer) so a client cannot
-    # spoof its recorded session IP; the backend trusts the leftmost value. If
-    # this nginx sits behind another trusted proxy, use $proxy_add_x_forwarded_for
-    # and make the backend read the appropriate hop instead.
+    # $proxy_add_x_forwarded_for appends the immediate peer to X-Forwarded-For,
+    # so when a parent proxy resolves the real client IP first, the backend
+    # (which reads the leftmost value) still sees it. Only switch to $remote_addr
+    # if this nginx is the outermost/edge proxy and you want to reject
+    # client-supplied X-Forwarded-For.
     location /api/ {
         proxy_pass http://127.0.0.1:8080;
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
     }
 }