fix(server): restore IPv6 /56 comment and fix rate-limit fallback bucket

ipKeyGenerator('') returned '' as the rate-limit key when both req.ip and
req.socket?.remoteAddress were undefined, silently merging all anonymous
requests into an empty-string bucket instead of the intended 'unknown' sentinel.

Switch to a conditional: only call ipKeyGenerator when an IP is present,
otherwise fall back to 'unknown'. Restores the IPv6 /56 normalisation
comment dropped in aa36869 (see issue #1360).

gitnexus/src/server/validation.ts

@@ -151,7 +151,13 @@ export function createRouteLimiter(opts?: RouteLimiterOverrides): RateLimitReque
     standardHeaders: 'draft-7',
     legacyHeaders: false,
     passOnStoreError: true,
-    keyGenerator: (req: Request) => ipKeyGenerator(req.ip ?? req.socket?.remoteAddress ?? ''),
+    keyGenerator: (req: Request) => {
+      // Pass through ipKeyGenerator so IPv6 addresses are normalised to their /56
+      // subnet — without this, each IPv6 address gets its own counter and the limit
+      // is trivially bypassed (#1360).
+      const ip = req.ip ?? req.socket?.remoteAddress;
+      return ip ? ipKeyGenerator(ip) : 'unknown';
+    },
     message: { error: 'Too many requests, please try again later.' },
     ...opts,
   });