Add ProxyFix middleware to get real client IP

HF Spaces uses reverse proxy, so X-Forwarded-For header
needs to be properly handled via ProxyFix middleware.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

app.py

@@ -62,6 +62,7 @@ from flask import (
     session,
     abort,
 )
+from werkzeug.middleware.proxy_fix import ProxyFix
 from flask_login import LoginManager, current_user
 from models import *
 from auth import auth, init_oauth, is_admin
@@ -131,6 +132,8 @@ if not IS_SPACES:
     load_dotenv()  # Only load .env if not running in a Hugging Face Space
 
 app = Flask(__name__)
+# Apply ProxyFix to handle X-Forwarded-For headers from HF Spaces proxy
+app.wsgi_app = ProxyFix(app.wsgi_app, x_for=1, x_proto=1, x_host=1, x_prefix=1)
 app.config["SECRET_KEY"] = os.getenv("SECRET_KEY", os.urandom(24))
 
 # Configure database path - use persistent storage in HF Spaces