fix(server): access log reports the real client, not the proxy — #2453

Closes the disagreement left open by #2453: requestlog.go logged raw
r.RemoteAddr while the Active-sessions surface resolved through the operator's
configured proxy depth. Behind a proxy — the normal deployment for anything
public — every access-log line carried the same useless proxy address, and the
two surfaces contradicted each other about who connected. Logs and UI
disagreeing is worse than either being wrong alone, because it costs you trust
in both.

`remote` now holds auth.ClientIP(r, hops). The attribute KEY is deliberately
unchanged so existing log greps keep working; only its accuracy improved.

Wiring note. The access log covers /healthz and the SPA, so it's registered
before the pool-bearing branch that used to build the settings service. Rather
than close over a variable reassigned later — which works, but leaves a
mutable-after-registration seam and an awkward question about races — I hoisted
netsettings.New above the router entirely. It already handles a nil pool by
returning a default-valued service, so no branch is needed and the accessor
stays a plain method value.

Applied the lesson from the last three CI failures BEFORE pushing this time: a
bare-identifier grep for `requestLog(` found three call sites in
requestlog_test.go that a qualified pattern could never have matched, since
the function is package-private and its tests are in-package. Also swept
netsettings.New and ClientIP the same way.

Tests: the behaviour change gets its own table — nil accessor and depth 0 log
the socket peer, depth 1 through a PUBLIC-addressed proxy logs the client
(the exact case the old heuristic got wrong forever), depth 2 reaches through
a CDN. Added `remote` to the required-keys assertion so the attribute can't
quietly disappear.

internal/server/server.go

@@ -113,8 +113,20 @@ func New(logger *slog.Logger, pool *pgxpool.Pool, scanner ScanTrigger, subCfg su
 
 func (s *Server) Router() http.Handler {
 	r := chi.NewRouter()
+
+	// Built before the router because the access log needs it, and the access
+	// log covers /healthz and the SPA — which exist whether or not there's a
+	// pool. netsettings.New handles a nil pool by returning a default-valued
+	// service, so this needs no branch and no later reassignment; hoisting it
+	// here keeps the accessor a plain method value instead of a closure over
+	// a variable mutated after the middleware is already registered.
+	netSettings, nsErr := netsettings.New(context.Background(), s.Pool, s.Logger)
+	if nsErr != nil {
+		s.Logger.Error("server: netsettings boot failed, using default hops", "err", nsErr)
+	}
+
 	r.Use(middleware.RequestID)
-	r.Use(requestLog(s.Logger))
+	r.Use(requestLog(s.Logger, netSettings.Hops))
 	r.Use(middleware.Recoverer)
 
 	r.Get("/healthz", s.handleHealthz)
@@ -165,14 +177,6 @@ func (s *Server) Router() http.Handler {
 				s.Logger.Error("server: recsettings boot failed", "err", err)
 			}
 		}
-		// Cached trusted-proxy depth (#2453). Constructed here rather than in
-		// main.go because nothing else needs it at boot, and New always hands
-		// back a usable service — a DB hiccup degrades to the default rather
-		// than breaking the authenticated request path that reads it.
-		netSettings, err := netsettings.New(context.Background(), s.Pool, s.Logger)
-		if err != nil {
-			s.Logger.Error("server: netsettings boot failed, using default hops", "err", err)
-		}
 		api.Mount(r, s.Pool, s.Logger, writer, s.RecommendationCfg, recSettings, lidarrCfg, lidarrReqs, lidarrQuar, tracksSvc, playlistsSvc, s.CoverEnricher, s.CoverSettings, s.TagSettings, s.LibraryScanner, s.ScanCfg, s.DataDir, smtpSender, bus, s.PlaylistScheduler, s.StreamSecret, netSettings)
 		// /api/admin/scan is the only admin route owned by the server package
 		// (it needs the Scanner). Register it as a single inline-middleware