feat: trust forwarded client addresses only from configured proxies (rate limit, audit, SSE) [CI]

Docs: access.md covers the missing node-side Backend identity and the hash-first install flow.

backend/src/MoShiro.Backend.Api/Admin/AuthEndpoints.cs

@@ -75,7 +75,7 @@ public static class AuthEndpoints
 
     private static async Task<IResult> LoginAsync(HttpContext http, LoginRequest request, AuthService auth, AuditService audit, LoginRateLimiter limiter, BackendOptions options)
     {
-        string source = http.Connection.RemoteIpAddress?.ToString() ?? "unknown";
+        string source = http.ClientAddress();
         if (!limiter.TryAcquire(source, out int retryAfter))
         {
             return Problems.RetryAfter(http, new FleetError(MoShiroErrors.TooManyRequests, "too many sign-in attempts"), retryAfter);
@@ -130,7 +130,7 @@ public static class AuthEndpoints
     /// <summary>限流。<paramref name="scope"/> 把「取挑战」和「提交登录」分成两个桶：页面加载取挑战不该占用登录失败的额度。</summary>
     private static IResult Limited(HttpContext http, LoginRateLimiter limiter, out bool ok, string scope = "", int? limit = null)
     {
-        string source = scope + (http.Connection.RemoteIpAddress?.ToString() ?? "unknown");
+        string source = scope + (http.ClientAddress());
         ok = limiter.TryAcquire(source, out int retryAfter, limit);
         return ok ? TypedResults.NoContent() : Problems.RetryAfter(http, new FleetError(MoShiroErrors.TooManyRequests, "too many sign-in attempts"), retryAfter);
     }
@@ -161,7 +161,7 @@ public static class AuthEndpoints
 
         Result<LoginResult> result = await passkeys.LoginAsync(
             new PasskeyAssertion(request.CredentialId ?? "", request.AuthenticatorData ?? "", request.ClientDataJson ?? "", request.Signature ?? ""), PasskeyContextOf(http, options), http.RequestAborted);
-        string? remote = http.Connection.RemoteIpAddress?.ToString();
+        string? remote = http.ClientAddress();
         if (!result.TryGet(out LoginResult? login, out FleetError? error))
         {
             await audit.RecordAsync(null, "?", AuthMethods.Passkey, "auth.login", null, null, remote, false, http.RequestAborted);
@@ -276,7 +276,7 @@ public static class AuthEndpoints
             principal, elevation, new PasskeyAssertion(request.CredentialId ?? "", request.AuthenticatorData ?? "", request.ClientDataJson ?? "", request.Signature ?? ""), PasskeyContextOf(http, options), http.RequestAborted);
         if (!result.TryGet(out ElevationWindow? window, out FleetError? error))
         {
-            await audit.RecordAsync(principal, "auth.elevate", null, Elevation.IdOf(elevation), http.Connection.RemoteIpAddress?.ToString(), false, http.RequestAborted);
+            await audit.RecordAsync(principal, "auth.elevate", null, Elevation.IdOf(elevation), http.ClientAddress(), false, http.RequestAborted);
             return Problems.From(http, error);
         }