feat: rebrand Hemmelig to paste.es for cloudhost.es

- Set Spanish as default language with ephemeral/encrypted privacy focus
- Translate all user-facing strings and legal pages to Spanish
- Replace Norwegian flag with Spanish flag in footer
- Remove Hemmelig/terces.cloud links, add cloudhost.es sponsorship
- Rewrite PrivacyPage: zero data collection, ephemeral design emphasis
- Rewrite TermsPage: Spanish law, RGPD, paste.es/CloudHost.es references
- Update PWA manifest, HTML meta tags, package.json branding
- Rename webhook headers to X-Paste-Event / X-Paste-Signature
- Update API docs title and contact to paste.es / cloudhost.es

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/middlewares/ip-restriction.ts

@@ -0,0 +1,33 @@
+import { Context, Next } from 'hono';
+import ipRangeCheck from 'ip-range-check';
+import prisma from '../lib/db';
+import { getClientIp } from '../lib/utils';
+
+export const ipRestriction = async (c: Context, next: Next) => {
+    const { id } = c.req.param();
+
+    const item = await prisma.secrets.findUnique({
+        where: { id },
+        select: {
+            ipRange: true,
+        },
+    });
+
+    // If no restriction is configured, move on
+    if (!item?.ipRange) {
+        return next();
+    }
+
+    const ip = getClientIp(c);
+
+    if (!ip) {
+        return c.json({ error: 'Could not identify client IP' }, 400);
+    }
+
+    // The core logic is now a single, clean line
+    if (!ipRangeCheck(ip, item.ipRange)) {
+        return c.json({ error: 'Access restricted by IP' }, 403);
+    }
+
+    await next();
+};