feat(06-05): trusted-proxy get_client_ip, per-account rate limiter, promote 8 xfail tests (D-11/D-12/D-13)

- D-11: replace get_client_ip body with trusted-proxy CIDR check (127/8, 172.16/12,
  192.168/16, ::1/128); untrusted peers always return their own IP, preventing XFF
  spoofing by external callers
- D-12: create services/rate_limiting.py with _account_key() keyed by user.id
  (falls back to peer IP when no authenticated user in request.state); exports
  account_limiter = Limiter(key_func=_account_key)
- Wire: auth.py switches from get_remote_address to get_client_ip; main.py imports
  account_limiter; all 9 documents.py endpoints and 7 cloud.py endpoints decorated
  @account_limiter.limit("100/minute") with request.state.current_user = current_user
  as the first handler statement (A1 ordering invariant)
- Promote all 8 xfail stubs to real assertions; add autouse fixture in conftest.py
  to reset MemoryStorage between tests preventing cross-test 429 contamination

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/tests/conftest.py

@@ -155,6 +155,22 @@ async def async_client(db_session: AsyncSession):
     app.dependency_overrides.clear()
 
 
+# ── Rate limiter reset — prevents cross-test contamination ───────────────────
+
+@pytest.fixture(autouse=True)
+def reset_rate_limiter():
+    """Reset the in-memory rate limiter storage before each test.
+
+    The account_limiter is a module-level singleton using MemoryStorage.
+    Without this fixture, rate limit counters accumulate across tests in the
+    same process and cause unrelated tests to receive 429 responses.
+    """
+    from services.rate_limiting import account_limiter
+    account_limiter._storage.reset()
+    yield
+    account_limiter._storage.reset()
+
+
 # ── File fixtures ─────────────────────────────────────────────────────────────
 
 @pytest.fixture