feat(auth): active sessions API with origin/current IP — #370

Server half of the active-sessions surface. Web UI follows.

The operator wants this specifically to notice a compromised account, which
sets the bar: the addresses have to be trustworthy, or the feature is worse
than absent because it looks like evidence.

Migration 0052 adds created_ip + last_ip. Two columns, not one, and the pair
is the signal: a session issued at home and now being used from elsewhere is
the shape of a stolen token, and neither column alone can show that. Typed
text, matching the user_agent column beside it — these are displayed, never
queried by subnet, and inet round-trips through pgx as a netip.Prefix that
renders "1.2.3.4/32".

The rest of the schema was already waiting. Migration 0004 anticipated this
exactly: "last_seen_at enables an 'active sessions' UI later (not wired in
this plan) without schema churn." last_seen_at is live data — the auth
middleware already touches it per request — so last_ip rides that same
UPDATE for free.

Getting the address right is the substance here. Nothing extracted a client
IP anywhere before, and both obvious approaches are wrong:

- RemoteAddr alone shows the reverse proxy on every session, which is the
  normal self-hosted deployment. Noise shaped like data.
- Trusting X-Forwarded-For lets any client choose what its victim sees. A
  security surface an attacker can write to is worse than none.

So auth.ClientIP trusts the header only when the request actually arrived
from a proxy range. Public RemoteAddr means a direct connection, so XFF is
attacker-controlled and ignored outright. Private RemoteAddr means we walk
XFF right-to-left — proxies append, so the right end is what our own
infrastructure wrote — and take the first non-proxy address. A forged XFF
only prepends to the left end, which that walk never reaches. Unit-tested,
including both spoofing shapes.

Fails closed on a public-addressed proxy (separate host, CDN): we report the
proxy rather than trusting a forgeable header. Documented at the function.

Endpoints, all scoped by user_id per rule #47:

  GET    /api/me/sessions                → list, flagging the current row
  DELETE /api/me/sessions/{id}           → 204, or 404 if not yours
  POST   /api/me/sessions/logout-others  → {"revoked": n}

Keyed on session id alone, any household member could revoke another's
session by guessing a uuid, so the delete carries user_id in its WHERE and
:execrows distinguishes "not yours" (404) from a false 204. There's a test
that asserts the row actually survives, not merely that we returned 404.

The middleware now also puts the session id in context. logout-others is
defined by exclusion, and without knowing which session is ours the
safe-looking action deletes everything including the caller's — so it
refuses rather than guesses when the id is absent, and that refusal is
tested for non-deletion too.

audit_log.action is plain text with no CHECK, so the two new actions need no
migration (rule #36 checked, not assumed).

Codegen is real sqlc 1.31.1 via the container in `make generate` — docker is
present on this workstation even though Go and sqlc aren't — rather than the
hand-written .sql.go shortcut used in milestone #268.

internal/auth/clientip.go

@@ -0,0 +1,92 @@
+package auth
+
+import (
+	"net"
+	"net/http"
+	"strings"
+)
+
+// ClientIP returns the caller's address for the active-sessions surface (#370).
+//
+// Both obvious implementations are wrong, and they're wrong in ways that
+// matter specifically because this feeds a compromise-detection UI:
+//
+//   - r.RemoteAddr alone. Minstrel is normally behind a reverse proxy, so
+//     every session would show the proxy's address — noise shaped like data,
+//     hiding the exact thing the operator is looking for.
+//   - Trusting X-Forwarded-For. Any client can set that header, so an
+//     attacker could choose what appears in their victim's session list.
+//     A security surface an attacker can write to is worse than none.
+//
+// So the header is trusted only when the request actually arrived from a
+// proxy. If RemoteAddr is public, the caller reached us directly and its XFF
+// is attacker-controlled, so it's ignored outright. If RemoteAddr is
+// private/loopback, XFF is walked from the RIGHT — entries are appended as a
+// request passes through infrastructure, so the rightmost end is the one our
+// own proxies wrote — and the first address that isn't itself a proxy range
+// wins. A client forging XFF can only prepend to the untrusted left end,
+// which that walk never reaches.
+//
+// Known limitation, failing closed on purpose: if the proxy sits on a PUBLIC
+// address (a separate host, or a CDN in front), RemoteAddr isn't in a proxy
+// range, so we report the proxy rather than the end user. That's a true fact
+// about where the request came from, which beats trusting a forgeable header.
+//
+// Returns "" when nothing usable can be determined. Callers store that as-is
+// and the UI renders "unknown" rather than inventing a value.
+func ClientIP(r *http.Request) string {
+	remote := hostOf(r.RemoteAddr)
+	ip := net.ParseIP(remote)
+	if ip == nil || !isProxyRange(ip) {
+		return remote
+	}
+	if forwarded := forwardedClient(r.Header.Get("X-Forwarded-For")); forwarded != "" {
+		return forwarded
+	}
+	// Some proxies set only X-Real-IP. The trust condition is already
+	// satisfied — we know this request came from a proxy range.
+	if real := net.ParseIP(strings.TrimSpace(r.Header.Get("X-Real-IP"))); real != nil {
+		return real.String()
+	}
+	return remote
+}
+
+// hostOf strips the port from a RemoteAddr, tolerating values that have none.
+func hostOf(remoteAddr string) string {
+	host, _, err := net.SplitHostPort(remoteAddr)
+	if err != nil {
+		return strings.TrimSpace(remoteAddr)
+	}
+	return host
+}
+
+// forwardedClient walks an X-Forwarded-For value right-to-left and returns
+// the first address outside our proxy ranges — see ClientIP for why the
+// direction matters. Returns "" if the header is absent, malformed, or
+// contains nothing but proxy addresses.
+func forwardedClient(header string) string {
+	parts := strings.Split(header, ",")
+	for i := len(parts) - 1; i >= 0; i-- {
+		ip := net.ParseIP(strings.TrimSpace(parts[i]))
+		if ip == nil || isProxyRange(ip) {
+			continue
+		}
+		return ip.String()
+	}
+	return ""
+}
+
+// isProxyRange reports whether ip is an address a reverse proxy would
+// plausibly occupy in a self-hosted deployment: loopback, RFC1918 / ULA
+// (both covered by IsPrivate), link-local, or unspecified.
+//
+// Deliberately not configurable. These ranges cover proxy-on-same-host and
+// proxy-on-the-same-docker-network, which is essentially every self-hosted
+// install, and it works with no setup at all (rule #26). An exotic topology
+// can motivate a setting when one actually turns up.
+func isProxyRange(ip net.IP) bool {
+	return ip.IsLoopback() ||
+		ip.IsPrivate() ||
+		ip.IsLinkLocalUnicast() ||
+		ip.IsUnspecified()
+}