R-753: the box tells visitors apart — cloudflared at a fixed address, traefik trusts only it, the controller reads the hop traefik saw

- felhom-tunnel network 172.16.253.0/29 (ip-range .4/30): cloudflared alone at .2, traefik at .3; traefik's websecure
  trusts forwarded headers from 172.16.253.2/32 only, and every request passes felhom-forwarded@file, which removes
  the client-writable host/path/address headers (X-Forwarded-Host/-Uri/-Method/-Prefix, Forwarded, True-Client-Ip, …)
  and fixes X-Forwarded-Port to 443 (measured: Cloudflare passes a client's X-Forwarded-Host/-Port).
- EnsureBaseStack reconciles a RUNNING traefik/cloudflared whose rendered files changed (recreate), refuses a rewrite
  that would drop a certificate resolver, and moves cloudflared only once traefik is on the tunnel network.
- clientIP: believed only when the TCP peer is traefik; the rightmost X-Forwarded-For entry (the hop traefik saw);
  the tunnel hop → CF-Connecting-IP (the edge refuses a client-sent one, measured 403). rateKey: IPv6 per /64.
  Dashboard login, claim, share and escrow counters key on it; the setup gate logs it.
- Dashboard login messages: keys, informal voice, both languages.
Red-proofs: RP-A1 (leftmost hop), RP-A2 (shared tunnel key), RP-A3 (no reconcile) — felhom.eu audits/visitors-2026-10-01/A.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/i18n/locales/en.json

@@ -2505,5 +2505,8 @@
   "backups_offsite.fit_quota": "storage limit:",
   "backups_offsite.fit_largest": "The largest:",
   "backups_offsite.fit_choose": "Turn off the off-site copy for the apps that do not need one outside the house. Until then the largest get only their settings and database uploaded, and once the limit is full no new off-site backup is made. The box does not delete old backups because of this.",
-  "flash.offbox.enabled_all": "Off-site backup is on for every app."
+  "flash.offbox.enabled_all": "Off-site backup is on for every app.",
+  "login.msg.empty_password": "Enter your password.",
+  "login.msg.rate_limited": "Too many wrong tries from this address. Try again in a minute.",
+  "login.msg.wrong_password": "Wrong password."
 }

controller/internal/i18n/locales/hu.json

@@ -1600,7 +1600,7 @@
   "layout.uzenet": "Üzenet",
   "layout.vezerlopult": "Vezérlőpult",
   "layout.visszaallitas": "Visszaállítás",
-  "login.adja_meg_a_jelszavat": "Adja meg a jelszavát",
+  "login.adja_meg_a_jelszavat": "Add meg a jelszavad",
   "login.bejelentkezes": "Bejelentkezés",
   "login.bejelentkezes_felhom": "Bejelentkezés — Felhom",
   "login.elfelejtett_jelszo": "Elfelejtett jelszó",
@@ -2493,5 +2493,8 @@
   "backups_offsite.fit_quota": "tárhelykeret:",
   "backups_offsite.fit_largest": "A legnagyobbak:",
   "backups_offsite.fit_choose": "Kapcsold ki a távoli mentést annál, amelyiknek nem kell a házon kívül is lennie. Addig a legnagyobbaknak csak a beállításai és az adatbázisa kerül fel, és ha a keret betelik, új távoli mentés nem készül. Régi mentést a doboz ezért nem töröl.",
-  "flash.offbox.enabled_all": "A távoli mentés be van kapcsolva minden alkalmazásra."
+  "flash.offbox.enabled_all": "A távoli mentés be van kapcsolva minden alkalmazásra.",
+  "login.msg.empty_password": "Add meg a jelszavad.",
+  "login.msg.rate_limited": "Túl sok hibás próbálkozás erről a címről. Próbáld újra egy perc múlva.",
+  "login.msg.wrong_password": "Hibás jelszó."
 }