fix: ProxyFix for real client IP behind NPM + nginx

zkart_app/__init__.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 from flask import Flask
+from werkzeug.middleware.proxy_fix import ProxyFix
 
 from .config import BASE_DIR, SECRET_KEY
 from .db import init_db
@@ -14,6 +15,8 @@ def create_app() -> Flask:
         static_folder=str(BASE_DIR / "static"),
     )
     app.secret_key = SECRET_KEY
+    # Trust 2 proxy hops: NPM → internal nginx → gunicorn
+    app.wsgi_app = ProxyFix(app.wsgi_app, x_for=2, x_proto=1, x_host=1)
     app.register_blueprint(bp)
     init_db()
     return app