fix(security): don't trust loopback socket as local when request arrives via reverse proxy

Co-authored-by: Cursor <cursoragent@cursor.com>

src/dashboardGuard.js

@@ -90,6 +90,9 @@ function isLoopbackHostname(h) {
 }
 
 export function isLocalRequest(request) {
+  // Stamped by custom-server.js when forwarding headers exist: request came through
+  // a reverse proxy, so the loopback socket is the proxy hop, not the end-user.
+  if (request.headers.get("x-9r-via-proxy")) return false;
   // Trusted peer IP from TCP socket (custom-server.js); unspoofable. Primary anchor for "local".
   const realIp = request.headers.get("x-9r-real-ip");
   if (realIp) {