fix: resolve webhook client IP behind proxies

deploy/docker/caddy/Caddyfile

@@ -2,11 +2,14 @@
 app.example.com {
 	encode zstd gzip
 
+	# Caddy sets X-Forwarded-For/Host/Proto for reverse_proxy by default.
+	# The backend uses X-Forwarded-For for payment provider IP allowlists.
 	reverse_proxy backend:8080
 }
 
 web.example.com {
 	encode zstd gzip
 
+	# Keep forwarded headers for Web App URL generation and request logging.
 	reverse_proxy frontend:80
 }

deploy/docker/nginx/remnawave-minishop.conf

@@ -72,6 +72,7 @@ server {
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
+        # Required for payment provider IP allowlists in webhook handlers.
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Host $host;
         proxy_set_header X-Forwarded-Proto $scheme;