Add Xquik publishing and harden webhook proxy trust

[kriptoburak]

Summary

• Add an opt-in Xquik publishing backend through TWITTER_BACKEND=xquik.
• Preserve Tweepy as the default and reuse the existing text cleanup for X and email output.
• Document the connected-account selector, API-key setup, OAuth-first MCP availability, and X Corp independence.
• Fix a separate webhook security defect: only trust X-Forwarded-For from the documented local reverse proxy, so direct clients cannot spoof a TradingView source IP.

Validation

• Installed the repository’s exact requirements.txt on Python 3.9.
• Exercised the Xquik request URL, header, account, cleaned text, timeout, response, and missing-config behavior.
• Exercised direct spoof rejection, trusted local-proxy forwarding, and direct TradingView-IP acceptance with Flask’s test client.
• python3 -m black --check config.py handler.py main.py
• python3 -m py_compile config.py handler.py main.py
• git diff --check

Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp.