fix(app-server): rate limit direct clients by IP

[OnlyYu1996]

Summary

• Serve the app with Axum ConnectInfo<SocketAddr> so request middleware has direct client connection metadata.
• Use the TCP peer IP for rate-limit keys when no API key or trusted proxy header applies.
• Preserve trusted proxy behavior by keeping X-Real-IP / X-Forwarded-For precedence when trust_proxy is enabled.
• Add regression coverage for direct-client and trusted-proxy rate-limit keys.

Fixes PlatformNetwork/bounty-challenge#53250

Verification

• cargo fmt --package cortex-app-server --check
• cargo test --package cortex-app-server rate_limit_key -- --nocapture
• cargo test --package cortex-app-server middleware::tests -- --nocapture
• cargo check --package cortex-app-server --lib
• git diff --check

[greptile-apps]

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.