- Correct per-endpoint rate limit tables to reflect actual single global config - Document RealIpKeyExtractor behavior (X-Real-IP / X-Forwarded-For behind proxy) - Add BAL_SERVER_TRUSTED_PROXY env var to all relevant docs - Update security audit and modules detail with proxy-aware rate limiting