fix: use real client IP for auth rate limiting; preserve lobby across socket disconnect

- Store real client IP from x-forwarded-for on socket for use in JOIN_ROOM
  auth rate limiting (was using proxy IP, breaking brute-force protection)
- Remove clearEpisodeLobbyState() from socket.onclose to preserve lobby
  across brief disconnects; ensureState() recovers lobby + timeout on reconnect
- Lobby is still properly cleared on intentional LEAVE_ROOM and room switch

extension/background.js

@@ -366,7 +366,6 @@ async function connect() {
                 forceSyncDeadline: null 
             });
 
-            clearEpisodeLobbyState();
             
             if (currentRoom) {
                 currentRoom.peers = [];

server/index.js

@@ -206,6 +206,7 @@ io.on('connection', (socket) => {
     // Get real client IP behind proxy/CDN
     const forwardedFor = socket.handshake.headers['x-forwarded-for'];
     const clientIp = forwardedFor ? forwardedFor.split(',')[0].trim() : socket.handshake.address;
+    socket._clientIp = clientIp;
     
     // 1. Connection Rate Limit
     if (!checkConnectionRate(clientIp)) {
@@ -283,7 +284,7 @@ io.on('connection', (socket) => {
                 removePeerFromRoom(socket.id, oldMapping.roomId, 'room-switch');
             }
 
-            const ip = socket.handshake.address;
+            const ip = socket._clientIp || socket.handshake.address;
             if (!checkAuthRate(ip, roomId)) {
                 socket.emit(EVENTS.ERROR, { message: "Too many failed attempts. Try again later." });
                 return;