Found in mission 010. hl:http1 drops client_addr (http1.zig), so `req` has no remote address; faces get only the session, no request context at all. An app cannot rate-limit per IP without a proxy header. Expected: `req.remoteAddress` and some request context (headers, peer) for faces.