chore: bump @indiekit peer deps to beta.27, fix duplicate validate keys in rate limiters

- @indiekit/endpoint-micropub, @indiekit/error, @indiekit/frontend: ^1.0.0-beta.25 → ^1.0.0-beta.27
- express-rate-limit: stays at ^7.5.1 (v8 has breaking changes to standardHeaders boolean and validate.trustProxy API)
- Remove duplicate validate: { trustProxy: false } keys in apiLimiter, authLimiter, appRegistrationLimiter

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

lib/mastodon/router.js

@@ -35,7 +35,6 @@ const apiLimiter = rateLimit({
   legacyHeaders: false,
   validate: { trustProxy: false }, // behind nginx reverse proxy; trust proxy is intentional
   message: { error: "Too many requests, please try again later" },
-  validate: { trustProxy: false },
 });
 
 const authLimiter = rateLimit({
@@ -45,7 +44,6 @@ const authLimiter = rateLimit({
   legacyHeaders: false,
   validate: { trustProxy: false },
   message: { error: "Too many authentication attempts" },
-  validate: { trustProxy: false },
 });
 
 const appRegistrationLimiter = rateLimit({
@@ -55,7 +53,6 @@ const appRegistrationLimiter = rateLimit({
   legacyHeaders: false,
   validate: { trustProxy: false },
   message: { error: "Too many app registrations" },
-  validate: { trustProxy: false },
 });
 
 /**

package.json

@@ -49,9 +49,9 @@
     "unfurl.js": "^6.4.0"
   },
   "peerDependencies": {
-    "@indiekit/endpoint-micropub": "^1.0.0-beta.25",
-    "@indiekit/error": "^1.0.0-beta.25",
-    "@indiekit/frontend": "^1.0.0-beta.25"
+    "@indiekit/endpoint-micropub": "^1.0.0-beta.27",
+    "@indiekit/error": "^1.0.0-beta.27",
+    "@indiekit/frontend": "^1.0.0-beta.27"
   },
   "publishConfig": {
     "access": "public"