see the real client IP behind ArvanCloud, and mark all notifications read in one call

Production is ArvanCloud -> nginx -> gunicorn, but NUM_PROXIES was 1, so DRF
took ArvanCloud's edge IP as the client: every guest and every OTP request
behind one edge shared a single throttle bucket (20 guest sessions an hour for
everyone). Default is now 2, and /api/health reports clientIp so the proxy
count can be checked from outside.

PATCH /api/notifications/read-all replaces the frontend's one-PATCH-per-item
loop, which spent the shared "read" budget 75 requests at a time.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

config/health.py

@@ -180,5 +180,10 @@ class HealthView(APIView):
             'integrations': _check_integrations(),
             'traffic': _traffic(),
             'allowedOrigins': list(getattr(settings, 'CORS_ALLOWED_ORIGINS', [])),
+            # IPای که throttle برای همین درخواست می‌بیند. باید IPِ عمومیِ خودِ
+            # صدازننده باشد؛ اگر IPِ ArvanCloud یا nginx بود، NUM_PROXIES غلط
+            # است و همه‌ی مهمان‌ها یک سهمِ مشترک دارند. فقط IPِ خودِ صدازننده
+            # را به خودش برمی‌گرداند، پس چیزی لو نمی‌دهد.
+            'clientIp': ScopedRateThrottle().get_ident(request),
         }
         return Response(payload, status=200 if critical_ok else 503)