update production setup

apps/api/src/index.ts

@@ -32,6 +32,12 @@ import paymentsRouter   from './routes/payments'
 
 const app  = express()
 const server = http.createServer(app)
+
+// Trust the first hop from a reverse proxy so req.ip and rate-limiting
+// use the real client IP (from X-Forwarded-For) rather than the proxy's IP.
+if (process.env.NODE_ENV === 'production') {
+  app.set('trust proxy', 1)
+}
 const v1 = '/api/v1'
 const defaultCorsOrigins = [
   'http://localhost:3000',