01a0ee50 - Store validated client metadata on request logs

[TaprootFreakAI]

EN:
Failed signups and logins left no client address, because the server never stored the request headers it already receives.
Each API log row and each diagnostic event now keeps a validated client IP, country, Cloudflare ray, user agent, accept-language, and origin.
Invalid values, the query string, forwarded-for, and the connection peer are not stored.
This lands on develop. Production keeps the old logs until a release.

DE:
Gescheiterte Anmeldungen und Logins hatten keine Client-Adresse, weil der Server die Header, die er schon bekommt, nicht gespeichert hat.
Jede API-Logzeile und jedes Diagnose-Ereignis behält jetzt eine geprüfte Client-IP, das Land, die Cloudflare-Ray, den User-Agent, Accept-Language und den Origin.
Ungültige Werte, der Query-String, Forwarded-For und der Verbindungs-Peer werden nicht gespeichert.
Das geht auf develop. Die Produktion behält die alten Logs, bis ein Release folgt.

Details

The audit table api_log gains nullable columns client_ip, client_country, cf_ray, user_agent, accept_language, and origin. Existing databases pick them up with ADD COLUMN IF NOT EXISTS. Debug JSON always includes the six fields, using null when a header is missing or fails validation.

CF-Connecting-IP is stored only as a real IPv4 or IPv6 address, including compressed and IPv4-mapped forms. Country codes are two letters or digits after uppercase, so the Tor code T1 is kept. The ray id must be 16 hex digits, a hyphen, and three letters. User agent and accept-language have controls removed and are cut at 200 characters. Origin is https://host with an optional port, or http://localhost / http://127.0.0.1 with an optional port.

Events emitted during the request, including auth.passkey.register.begin and auth.passkey.login.fail, receive the same present fields. An explicit field on the event wins. POST /diagnostics stores them on the client row and still rejects clientIp as a body key. The per-IP rate limit is unchanged.

Not stored: query string, body, Authorization, cookies, tokens, view keys, Referer, raw X-Forwarded-For, or the TCP peer.

[TaprootFreakAI]

EN:
Ready after 2 review passes.
Each request log and each event emitted during that request now stores a validated client IP, country, ray, user agent, accept-language, and origin, and a diagnostics report stores the same present fields.

DE:
Bereit nach 2 Review-Durchläufen.
Jedes Request-Log und jedes während des Requests ausgegebene Ereignis speichert jetzt eine geprüfte Client-IP, das Land, die Ray, den User-Agent, Accept-Language und den Origin, und ein Diagnostics-Bericht speichert dieselben vorhandenen Felder.

Details

Pass 1 found three conformance gaps, fixed in 8be6f51: the two new functions lacked parameter docs, the diagnostics test claimed invalid headers were omitted without sending an invalid ray, and the project tree omitted the new files. Logic reported no defects. A note that a bracketed IPv6 origin is stored as null was rejected, because origin stays hostname-form https, localhost, or 127.0.0.1. A wording note on the return text was rejected, because the validators are unchanged.

Pass 2 on 8be6f51 reported no conformance or logic defects.

The pull-request check on that commit passed. The pull request is mergeable. No review comments or threads were open.