Replace chi middleware.RealIP with rest.RealIP on the main router

Behaviour-preserving swap: rest.RealIP sets r.RemoteAddr from
X-Real-IP / X-Forwarded-For like chi's middleware.RealIP, removing chi from
the RealIP path without changing the trust model (GHSA-56x6-q882-mf27 stays
present, to be fixed separately). chi/middleware stays imported for Timeout;
whichever of this PR and the Timeout PR (#2097) merges last drops the import.
Drop-in to a tested rest middleware; covered by existing api router tests.

backend/app/rest/api/rest.go

@@ -221,7 +221,7 @@ func (s *Rest) routes() chi.Router {
 		s.openRouteLimiter = openRouteLimiter
 	}
 	router := chi.NewRouter()
-	router.Use(R.Throttle(1000), middleware.RealIP, R.Recoverer(log.Default()))
+	router.Use(R.Throttle(1000), R.RealIP, R.Recoverer(log.Default()))
 	router.Use(securityHeadersMiddleware(s.ExternalImageProxy, s.AllowedAncestors))
 	if !s.DisableSignature {
 		router.Use(R.AppInfo("remark42", "umputun", s.Version))
@@ -785,7 +785,7 @@ func parseError(err error, defaultCode int) (code int) {
 
 // rateLimiter creates a rate limiting middleware with proper IP lookup configuration.
 // tollbooth v8 requires explicit IP lookup method to be set.
-// uses RemoteAddr which is set by chi's middleware.RealIP to the real client IP
+// uses RemoteAddr which is set by rest.RealIP to the real client IP
 // from X-Forwarded-For, X-Real-IP, or True-Client-IP headers.
 func rateLimiter(maxReq float64) func(http.Handler) http.Handler {
 	lmt := tollbooth.NewLimiter(maxReq, nil)