Align deployment ports and trusted proxy configuration

Run the dedicated calendar worker, bind the web service to loopback port 21005, and match the host nginx upstream.

Trust forwarded headers only from the Docker subnet and replace untrusted forwarded client chains at the public proxy. Validate Compose without resolving production environment files; do not restart services.

deploy/nginx/alpha.134333.xyz.conf

@@ -1,4 +1,4 @@
-# alpha.134333.xyz -> AlphaPulse web 容器（127.0.0.1:21030）
+# alpha.134333.xyz -> AlphaPulse web 容器（127.0.0.1:21005）
 
 server {
   listen 80;
@@ -16,7 +16,7 @@ server {
   error_log /var/log/nginx/alpha.134333.xyz.error.log warn;
 
   location / {
-    proxy_pass http://127.0.0.1:21030;
+    proxy_pass http://127.0.0.1:21005;
     proxy_http_version 1.1;
     # SSE 不缓冲；WebSocket 需要升级头
     proxy_buffering off;
@@ -25,7 +25,7 @@ server {
     proxy_set_header Host $http_host;
     proxy_set_header X-Forwarded-Proto $scheme;
     proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-For $remote_addr;
     proxy_read_timeout 1h;
   }
 }