R-776: vikunja sees each visitor behind the tunnel (trusted docker networks; 9202 checklist 3.6 re-measure owed)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

templates/vikunja/docker-compose.yml

@@ -19,6 +19,11 @@ services:
       - TZ=Europe/Budapest
       - VIKUNJA_SERVICE_PUBLICURL=https://${SUBDOMAIN}.${DOMAIN}
       - VIKUNJA_SERVICE_JWTSECRET=${VIKUNJA_SERVICE_JWTSECRET}
+      # R-776 (R-753, controller >= 0.286.0): the default `direct` reads the TCP peer (traefik) — one address for every
+      # visitor, so a stranger trips the login floor (10/min per address) for the household. `xff` walks X-Forwarded-For
+      # from the RIGHT skipping private addresses (echo's default trust): the tunnel's real visitor, or the LAN client.
+      # 9202 re-measure owed (checklist 3.6).
+      - VIKUNJA_SERVICE_IPEXTRACTIONMETHOD=xff
     volumes:
       - vikunja_data:/app/vikunja/files
       - vikunja_db:/db