fix(server,core): use SmartIpKeyExtractor for rate limiter, collapse nested if

- tower_governor: switch from PeerIpKeyExtractor (socket address) to
  SmartIpKeyExtractor so x-forwarded-for headers are honoured in tests
  and behind reverse proxies. Fixes auth_rate_limit_returns_429 test
  returning 500 instead of 429.
- solitaire_core: collapse nested if/if-let per clippy::collapsible_if.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

solitaire_core/src/game_state.rs

@@ -289,10 +289,9 @@ impl GameState {
             .ok_or(MoveError::InvalidSource)?
             .cards
             .last_mut()
+            && !top.face_up
         {
-            if !top.face_up {
-                top.face_up = true;
-            }
+            top.face_up = true;
         }
 
         self.piles.get_mut(&to).ok_or(MoveError::InvalidDestination)?.cards.append(&mut moved);