fix: recover the customer address behind the host reverse proxy

The production gateway does not face the internet: nginx-proxy-manager owns
80/443 on the host and proxies to it. So $remote_addr inside the gateway is that
proxy, and overwriting X-Forwarded-For with it discarded the customer address
the proxy had already recorded. Every request would have been attributed to one
internal address, which is exactly the fault 2.1 set out to fix, reintroduced in
production only.

Use real_ip to take the customer address from the proxy's header, trusting only
private networks. A request that reaches the published port directly from the
internet is not trusted, so its header is ignored and $remote_addr stays the
real peer: the anti-spoofing property is kept.

Also downgrade 2.9. TLS is not missing, it is terminated by that proxy. The gap
is that the repository never says so, which would break every session cookie if
the stack moved to a host without one.

Validated with nginx -t against the rendered production configuration.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

ROADMAP.md

@@ -240,11 +240,18 @@ records the same name for everyone. The meeting asked for traceability, and the
 `kanban/main.py` explicitly designed separation of duties (Mayana classifies,
 Thales/Alexandre authorise). Needs real per-person accounts with roles.
 
-### `[ ]` 2.9 — No TLS in the stack `(F13)`
+### `[~]` 2.9 — TLS is terminated outside the repository `(F13)`
 
-Ports publish plain HTTP on 18080/18081 while `COOKIE_SECURE: "true"` — cookies are
-silently dropped unless something external terminates TLS. Nothing in the repo
-provisions certificates; `TAREFAS.md` A2 still lists it as pending.
+Downgraded 2026-09-21. The stack publishes plain HTTP on 18080/18081 while
+`COOKIE_SECURE: "true"`, and nothing in the repo provisions certificates — but
+`nginx-proxy-manager` on the host owns 80/443 and terminates TLS in front of it,
+so cookies are not being dropped in practice. This is undocumented operational
+knowledge rather than a live defect.
+
+What remains: record the proxy in `PORTAINER.md` as part of the deployment
+contract, so nobody moves the stack to a host without one and silently breaks
+every session cookie. `TAREFAS.md` A2 still lists the certificate as pending;
+confirm it is actually issued for the DTF subdomain.
 
 ### `[ ]` 2.10 — No email verification, no password recovery `(F14)`
 
@@ -463,6 +470,17 @@ charges. Fix as part of 1.1.
   nginx 1.31.6. With both images at zero CRITICAL, the image scan now **gates on
   CRITICAL** and reports HIGH.
 
+### 2026-09-21 — from the runner host inventory
+
+- `[x]` Fixed a regression in 2.1: the production gateway sits behind
+  `nginx-proxy-manager`, so `$remote_addr` there is the proxy, not the customer.
+  Overwriting `X-Forwarded-For` with it would have recorded the proxy's address for
+  every request in production — the same bug 2.1 set out to fix. The gateway now
+  uses `real_ip` to recover the customer's address from the proxy's header, trusting
+  only private networks, so a request arriving directly at the published port
+  cannot spoof it. Validated with `nginx -t` against the rendered config.
+- `[~]` 2.9 downgraded: TLS is terminated by that proxy, not missing.
+
 ### Reporting
 
 - `[x]` Week-1 client report (`Relatorio-Semana-1-DTF.docx`), corrected 2026-09-18 to