fix: set trust proxy for rate limiter

src/index.ts

@@ -12,12 +12,17 @@ const port = process.env.PORT || 3001;
 // P0-6: Rate Limiting
 const limiter = rateLimit({
   windowMs: 24 * 60 * 60 * 1000, // 24 hours
-  max: 200, // limit each IP to 200 requests per windowMs
+  max: 5000, // limit each IP to 5000 requests per windowMs (increased for dev/testing)
   message: { error: 'Günlük kullanım limitine ulaştınız. (Too many requests)' }
 });
 
 app.use(cors());
 app.use(express.json());
+
+// If your app is behind a proxy (like Nginx, Docker ingress, etc.),
+// the IP will default to the proxy's IP. We set trust proxy to get the real client IP.
+app.set('trust proxy', 1); 
+
 app.use(limiter); // Apply rate limiting to all requests
 
 // Mount all API routes