docs: refresh reverse proxy hardening refs

docs/install/exe-dev.md

@@ -93,7 +93,7 @@ server {
         # Standard proxy headers
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-For $remote_addr;
         proxy_set_header X-Forwarded-Proto $scheme;
 
         # Timeout settings for long-lived connections
@@ -103,6 +103,10 @@ server {
 }
 ```
 
+Overwrite forwarding headers instead of preserving client-supplied chains.
+OpenClaw trusts forwarded IP metadata only from explicitly configured proxies,
+and append-style `X-Forwarded-For` chains are treated as a hardening risk.
+
 ## 5) Access OpenClaw and grant privileges
 
 Access `https://<vm-name>.exe.xyz/` (see the Control UI output from onboarding). If it prompts for auth, paste the