feat: trust forwarded client addresses only from configured proxies (rate limit, audit, SSE) [CI]

Docs: access.md covers the missing node-side Backend identity and the hash-first install flow.

backend/src/MoShiro.Backend.Api/Common/Guards.cs

@@ -109,7 +109,7 @@ public static class CapabilityGuard
             {
                 http.Items.TryGetValue(AuditEndpoints.DetailItem, out object? detail);
                 return http.RequestServices.GetRequiredService<AuditService>()
-                    .RecordAsync(principal, action, target, detail as string, http.Connection.RemoteIpAddress?.ToString(), http.Response.StatusCode < 400).AsTask();
+                    .RecordAsync(principal, action, target, detail as string, http.ClientAddress(), http.Response.StatusCode < 400).AsTask();
             });
         }