fix: remove request.ip which was removed in Next.js 15+

The request.ip property no longer exists on NextRequest in Next.js 15+.
Fall back to x-real-ip (set by trusted reverse proxies) then x-forwarded-for.
The security intent from PR #4 is preserved — x-real-ip is preferred over
the more easily spoofed x-forwarded-for header.

Fixes build error: Property 'ip' does not exist on type 'NextRequest'

app/api/auth/route.ts

@@ -12,9 +12,10 @@ const AUTH_RPM = 10;
 
 export async function POST(request: NextRequest) {
   // ── Rate limiting (brute-force protection) ──────────
-  // Security: Prioritize request.ip and x-real-ip to prevent x-forwarded-for spoofing
+  // Security: Prioritize x-real-ip (set by trusted reverse proxies like nginx/Traefik)
+  // over x-forwarded-for which can be spoofed by clients.
+  // Note: request.ip was removed in Next.js 15+.
   const ip =
-    request.ip ??
     request.headers.get('x-real-ip') ??
     request.headers.get('x-forwarded-for')?.split(',')[0].trim() ??
     'unknown';

app/api/image/[id]/route.ts

@@ -26,9 +26,10 @@ function widthToSize(w: number): ImageSize {
 
 export async function GET(request: NextRequest, { params }: { params: Promise<{ id: string }> }) {
   // ── Rate limiting ──────────────────────────────────
-  // Security: Prioritize request.ip and x-real-ip to prevent x-forwarded-for spoofing
+  // Security: Prioritize x-real-ip (set by trusted reverse proxies like nginx/Traefik)
+  // over x-forwarded-for which can be spoofed by clients.
+  // Note: request.ip was removed in Next.js 15+.
   const ip =
-    request.ip ??
     request.headers.get('x-real-ip') ??
     request.headers.get('x-forwarded-for')?.split(',')[0].trim() ??
     'unknown';