Scan the X-Forwarded-For chain without splitting it (closes #133)

The 64-hop cap bounded the walk but not the allocation: the chain was
split before it was capped, so a padded header cost a []string
proportional to its whole length on every request to the
unauthenticated receiver.

Cut hops off the right end of each header value in place with
strings.LastIndexByte instead, and walk multiple header values in
reverse rather than joining them. Bucket assignment is unchanged: the
walk still counts every comma-separated entry against the cap, skips
empty ones, stops at the first hop that is not a trusted proxy, and
falls back to the peer on an unreadable hop or an exhausted cap.

Measured over a 1 MB chain: 1,606,043 bytes allocated per call before,
16 bytes after.

internal/middleware/ratelimit_test.go

@@ -8,6 +8,7 @@ import (
 	"net/http/httptest"
 	"net/netip"
 	"os"
+	"runtime"
 	"strings"
 	"testing"
 	"time"
@@ -609,6 +610,66 @@ func TestRateLimitKey_LongChainCapsWalkAndFallsBackToPeer(
 	)
 }
 
+// TestRateLimitKey_LongChainAllocationIsBounded is the allocation
+// half of the hop cap. Capping the walk still left every request
+// paying for the whole header the client sent, because the chain was
+// split before it was capped: about 8 MB of []string for the 1 MB a
+// default MaxHeaderBytes allows, on the unauthenticated receiver.
+//
+// Bytes are the measurement, not allocation count: strings.Split of a
+// 1 MB chain is a single allocation, so testing.AllocsPerRun scores
+// it as cheap. The test is deliberately sequential — it reads
+// process-wide counters, and Go runs this package's parallel tests
+// only after the sequential ones finish.
+//
+//nolint:paralleltest // reads process-wide allocation counters
+func TestRateLimitKey_LongChainAllocationIsBounded(t *testing.T) {
+	// 100k hops of ", 10.0.0.2" is roughly 1 MB.
+	const (
+		hops            = 100000
+		iterations      = 50
+		maxBytesPerCall = 4096
+	)
+
+	m := rateLimitMiddleware(t, &config.Config{
+		TrustedProxies: trustedProxies("10.0.0.0/8"),
+	})
+
+	req := httptest.NewRequestWithContext(
+		context.Background(), http.MethodPost, loginPath, nil,
+	)
+	req.RemoteAddr = "10.0.0.1:44444"
+	req.Header.Set(
+		headerXFF, "9.9.9.9"+strings.Repeat(", 10.0.0.2", hops),
+	)
+
+	var before, after runtime.MemStats
+
+	var key string
+
+	runtime.ReadMemStats(&before)
+
+	for range iterations {
+		key = middleware.ClientKeyForTest(m, req)
+	}
+
+	runtime.ReadMemStats(&after)
+
+	perCall := (after.TotalAlloc - before.TotalAlloc) / iterations
+
+	assert.Less(
+		t, perCall, uint64(maxBytesPerCall),
+		"a %d-byte X-Forwarded-For must not allocate in proportion "+
+			"to its length, but cost %d bytes per call",
+		len(req.Header.Get(headerXFF)), perCall,
+	)
+
+	assert.Equal(
+		t, "10.0.0.1", key,
+		"the padded chain must still fall back to the peer address",
+	)
+}
+
 // TestReceiverRateLimit_IgnoresForwardedFromUntrustedPeer proves
 // the receiver limiter uses the same gated key function as the
 // POST limiters.