fix(request): use first forwarded host

[bun-unsafe]

Problem

When a trusted proxy sends a multi-hop X-Forwarded-Host header, HttpRequest#host() returns the entire comma-separated value. This also corrupts hostname() and completeUrl().

Fix

Use the first forwarded host, consistent with the existing X-Forwarded-Proto handling.

Testing

• npm run quick:test
• npm run typecheck
• npm run lint