8ec434d67e
Parse only the first IP from X-Forwarded-For to prevent the full chain from bypassing anonymization. Add secondary sort key for deterministic consent selection. Reject origins with empty port suffix in the validator. Signed-off-by: Émile Ré <emile@getprobo.com>