claude suggestions

bootstrap/app.php

@@ -23,6 +23,19 @@
         // has set URL::defaults(['locale' => …]), so route() needs no locale arg.
         $middleware->redirectGuestsTo(fn () => route('login'));
         $middleware->redirectUsersTo(fn () => route('home'));
+
+        // In production, the host's reverse proxy talks to the nginx container
+        // (bound to 127.0.0.1 only), so without this every visitor has the
+        // proxy's IP: the per-IP `throttle` limits on login become one shared
+        // bucket for the whole site. '*' trusts only the direct hop.
+        $middleware->trustProxies(at: '*');
+
+        // Enforces core's session registry: a session revoked via
+        // UserSessionService is logged out on its next request. Core leaves
+        // registering this to the app.
+        $middleware->web(append: [
+            \Modules\Core\Auth\Http\Middleware\EnsureSessionNotRevoked::class,
+        ]);
     })
     ->withExceptions(function (Exceptions $exceptions): void {
         //