Security: model budget + concurrency caps, SSRF guards, spoof-proof limits

Audit pass with the threats that actually apply to a self-hosted, account-less
app: getting the Ollama key throttled or banned, and someone grinding the app
down. Per-route windows already existed; these are the missing layers.

- lib/model-guard.ts: every route that spends a model call now takes a slot —
  60 calls per window across all clients (RATE_LIMIT_MODEL_TOTAL), 3 in flight
  per IP, 6 in total — and the slot is released when the call finishes, on
  errors and on client disconnects. Over the concurrency cap answers 429
  kind=busy, not a punishment. Slots are taken after every cheap rejection so
  a malformed request cannot hold one (found by the new suite: early 400s
  were leaking slots).
- Images must be base64 data URLs (dataUrlSchema in lib/schemas): a plain URL
  in an images field made Ollama fetch an arbitrary address on our behalf.
- Push endpoints must be a real push service (PUSH_ALLOWED_HOSTS, defaulting
  to FCM/Mozilla/Apple/WNS): the server POSTs to whatever is stored.
- The rate-limit identity is the LAST x-forwarded-for hop. Reading the first
  let a client spoof its own IP and dodge every per-IP limit.
- Disk guards: reports.jsonl stops at REPORTS_MAX_BYTES (8 MB), reminder
  devices cap at PUSH_MAX_SUBSCRIPTIONS (50).
- Security headers: frame-ancestors 'none' + X-Frame-Options DENY, nosniff, a
  referrer policy and a Permissions-Policy without camera/mic/geo/payment.

New tests/security-test.mjs (13 checks, registered in run-all) proves each
guard against a slow stub Ollama with deliberately tiny limits. README:
security notes + rate-limit tables updated. Version 0.1.3, SW -> v51.

lib/rate-limit.ts

@@ -73,12 +73,53 @@ function prune(now: number, windowMs: number): void {
   }
 }
 
+/* ------------------------------------------------------------------ */
+/* In-flight slots (concurrency, not per-window)                       */
+/* ------------------------------------------------------------------ */
+
+/**
+ * Per-window limits alone let a client fire every allowed request at once:
+ * ten parallel model calls still hammer Ollama (and hold ten sockets). These
+ * counters cap what is running *right now*. Kept on globalThis for the same
+ * reason as the buckets.
+ */
+const slotStore = globalThis as unknown as { __freezmoSlots?: Map<string, number> };
+const slots: Map<string, number> = (slotStore.__freezmoSlots ??= new Map());
+
+/** Take one of `max` in-flight slots for `key`. */
+export function acquireSlot(key: string, max: number): boolean {
+  const current = slots.get(key) ?? 0;
+  if (current >= max) return false;
+  slots.set(key, current + 1);
+  return true;
+}
+
+/** Give an in-flight slot back. */
+export function releaseSlot(key: string): void {
+  const current = slots.get(key) ?? 0;
+  if (current <= 1) slots.delete(key);
+  else slots.set(key, current - 1);
+}
+
+/** How many slots are in flight for a key (diagnostics and tests). */
+export function inFlight(key: string): number {
+  return slots.get(key) ?? 0;
+}
+
 /** Best-effort client identity: proxy headers first, then a shared bucket. */
 export function clientKey(request: Request): string {
   const forwarded = request.headers.get("x-forwarded-for");
   if (forwarded) {
-    const first = forwarded.split(",")[0]?.trim();
-    if (first) return first;
+    // Take the **last** hop, not the first: our reverse proxy appends the peer
+    // it saw, so the last entry is the one connection we can trust. Reading the
+    // first entry would let a client send its own `x-forwarded-for` and dodge
+    // every per-IP limit.
+    const hops = forwarded
+      .split(",")
+      .map((entry) => entry.trim())
+      .filter(Boolean);
+    const last = hops.at(-1);
+    if (last) return last;
   }
   return (
     request.headers.get("x-real-ip") ??