store real client IP in audit logs instead of Traefik proxy IP

[oveldman]

Summary

Audit logs were recording the internal Traefik IP (e.g. 10.1.9.123) instead of the real client IP. Two issues combined to cause this: ASP.NET Core's forwarded headers middleware only trusts loopback proxies by default, so X-Forwarded-For from Traefik was silently ignored; and when the server runs on a dual-stack socket, IPv4 connections arrive as IPv4-mapped IPv6 addresses (::ffff:x.x.x.x) which were stored as-is.

Changes

• Api/Program.cs & Status/Program.cs — Clear KnownIPNetworks and KnownProxies so X-Forwarded-For from Traefik is trusted
• IpAddress.cs — Normalize IPv4-mapped IPv6 addresses (::ffff:x.x.x.x → x.x.x.x) when constructing the value object

How to Test

• Make an API request through Traefik and verify the audit log stores the real client IP (e.g. 89.99.250.35) instead of the internal proxy IP (10.1.9.x)

Checklist

• Code builds without errors
• Changes have been tested locally
• No new warnings introduced

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud