## RP-A1 mutant: clientIP = the pre-R-753 LEFTMOST X-Forwarded-For hop (2026-10-01T18:37:48Z)
=== RUN   TestClientIP_Paths
    clientaddr_test.go:76: tunnel, forged leftmost: clientIP(remote="172.18.0.3:5000" xff="6.6.6.6,37.191.56.193, 172.16.253.2" cf="37.191.56.193") = "6.6.6.6", want "37.191.56.193"
    clientaddr_test.go:76: gate request through the tunnel: clientIP(remote="172.18.0.3:5000" xff="172.16.253.2" cf="203.0.113.50") = "172.16.253.2", want "203.0.113.50"
    clientaddr_test.go:76: direct, forged headers: clientIP(remote="192.168.0.50:4000" xff="1.2.3.4" cf="5.6.7.8") = "1.2.3.4", want "192.168.0.50"
    clientaddr_test.go:76: old cloudflared address: clientIP(remote="172.18.0.3:5000" xff="6.6.6.6, 172.18.0.5" cf="9.9.9.9") = "6.6.6.6", want "172.18.0.5"
    clientaddr_test.go:76: traefik, garbage hop: clientIP(remote="172.18.0.3:5000" xff="1.2.3.4, garbage" cf="") = "1.2.3.4", want "172.18.0.3"
--- FAIL: TestClientIP_Paths (0.00s)
=== RUN   TestLogin_StrangerThroughTheTunnelLocksOnlyHimself
    clientaddr_test.go:156: the stranger rotating a forged leftmost address must be locked after 5 tries; got: 
--- FAIL: TestLogin_StrangerThroughTheTunnelLocksOnlyHimself (0.11s)
=== RUN   TestLoginRateLimit_RotatingXFF_Limited
    ratelimit_ip_test.go:90: a rotating X-Forwarded-For from a direct peer must NOT evade the counter; got: 
--- FAIL: TestLoginRateLimit_RotatingXFF_Limited (0.11s)
FAIL
FAIL	gitea.dooplex.hu/admin/felhom-controller/internal/web	0.268s
FAIL
