fix: extract client IP via net.SplitHostPort consistently

Ultraworked with Sisyphus (https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

backend/mw/ratelimit.go

@@ -3,6 +3,7 @@ package mw
 import (
 	"net/http"
 	"sync"
+	"net"
 	"time"
 )
 
@@ -79,13 +80,10 @@ func RateLimit(limit int, window time.Duration) func(http.Handler) http.Handler
 			// Get client IP
 			ip := r.Header.Get("CF-Connecting-IP")
 			if ip == "" {
-				ip = r.Header.Get("X-Real-IP")
-			}
-			if ip == "" {
-				ip = r.Header.Get("X-Forwarded-For")
-			}
-			if ip == "" {
-				ip = r.RemoteAddr
+				ip, _, _ = net.SplitHostPort(r.RemoteAddr)
+				if ip == "" {
+					ip = r.RemoteAddr
+				}
 			}
 
 			if !limiter.Allow(ip) {