express-rate-limit throws ERR_ERL_UNEXPECTED_X_FORWARDED_FOR behind AWS ALB

**Description:**
When running jambonz-api-server behind an AWS Application Load Balancer, the server receives an X-Forwarded-For header automatically injected by the ALB. However, since the Express trust proxy setting defaults to false, express-rate-limit rejects this header and throws the following error:

```
ValidationError: The 'X-Forwarded-For' header is set but the Express 'trust proxy' setting is false (default).
This could indicate a misconfiguration which would prevent express-rate-limit from accurately identifying users.
See https://express-rate-limit.github.io/ERR_ERL_UNEXPECTED_X_FORWARDED_FOR/ for more information.
```

**Steps to reproduce:**

1. Deploy the API server behind an AWS Application Load Balancer.
2. Enable express-rate-limit.
3. Send any request — the error is triggered immediately.

**Root cause:**
The ALB always sets the X-Forwarded-For header. Since Express trust proxy is not enabled, express-rate-limit cannot trust this header and raises an error.

**Proposed fix:**
Configure Express to trust proxy headers from the ALB, for example:

```
// trust all proxies
app.set('trust proxy', true);

// OR, safer: trust only loopback (if ALB is terminating on localhost)
app.set('trust proxy', 'loopback');
```

This ensures that express-rate-limit can correctly resolve the client IP while still keeping security intact.

Locate the Express application initialization and express-rate-limit setup, then reproduce the failure behind an AWS Application Load Balancer. Determine the appropriate proxy trust configuration for this deployment and verify that requests no longer trigger ERR_ERL_UNEXPECTED_X_FORWARDED_FOR while client IP resolution remains safe.

Written by the indexing model from the issue text.