Fix endpoint XSS & rate-limit spoofing, add PLATFORM config

[botre]

Summary

Security fixes from an app-side review, plus a PLATFORM env var that makes httphq portable across hosting providers. Final commit is a repo-wide Prettier pass (formatting only).

P1 — Reflected XSS via the endpoint path param (high)

endpoint.html rendered {{.EndpointURL}} into an Alpine @click expression. Go's html/template only treats on* attributes as JS contexts, so @click was merely HTML-escaped — a ' supplied as %27 in the path survived, broke out of the copy('...') string, and Alpine evaluated the rest via the Function constructor (permitted by the CSP's 'unsafe-eval'). Any single-segment path renders the endpoint page, so the attack was a crafted link, e.g. /x%27%29%3Balert(1)%3B%28%27.

• The copy button now reads the URL from the DOM (x-ref="endpointUrl") instead of interpolating a template value into a JS expression.
• validEndpointID() (regex ^[a-z0-9]+(-[a-z0-9]+)*$, max 64 chars) rejects any non-haikunator :endpoint param with a 404, applied across GET /:endpoint, Use /to/:endpoint, GET /ws/:endpoint, and the /api/endpoints/:endpoint/... routes. The charset excludes ' " < > ( ) ; %, independently killing the XSS class and keeping junk out of the DB/logs.

P3 — Rate-limit bypass + spoofed client IP (medium)

With TrustProxy: true, both resolveClientIP and the limiter's key read a client-supplied X-Forwarded-For (Cloudflare appends to it rather than stripping it). Rotating XFF handed out a fresh rate-limit bucket per request and poisoned the stored/logged client IP. The limiter now keys on the resolved client IP; resolveClientIP is driven by the PLATFORM config below.

PLATFORM env var

httphq runs behind different providers depending on where it's self-hosted, each exposing the real client IP under its own header. PLATFORM lets the operator declare their provider; httphq resolves the client-IP strategy from it.

PLATFORM	Client IP source
unset / direct	TCP connection peer (no proxy)
cloudflare	CF-Connecting-IP
fly	Fly-Client-IP
heroku	X-Forwarded-For (leftmost)
render	X-Forwarded-For (leftmost)
proxy	X-Forwarded-For (leftmost) — generic proxy

• Declaring the platform also strips its vendor headers (e.g. Cloudflare's Cf-*) from captured requests, so users inspect their own traffic without infrastructure noise. Cdn-Loop (a standard CDN header) joins the generic omittedHeaders list.
• TrustProxy is now conditional on a platform being set — a directly exposed deployment no longer trusts forwarded headers.
• An unknown PLATFORM fails safe to direct. README documents PLATFORM, APPLICATION_ENV, and LOG_LEVEL.

Trust model

Setting PLATFORM trusts that platform's client-IP header unconditionally — the operator must ensure inbound traffic can't bypass the platform, or a client could spoof its IP. Documented in the README.

Testing

• go build ./src, go vet ./src, go test ./... pass.
• validEndpointID, resolvePlatform, and omitHeader covered by focused tests during development (XSS payload, platform mapping, header stripping); the repo keeps no main-package tests so they were not committed.
• Live curl / Playwright checks were not run locally due to a port-8080 conflict with an unrelated container; e2e uses haikunator-format IDs so endpoint validation won't reject it.