feat(net): canonical trusted-client-IP resolver (#442) [stacked on #472]

src/pinky_daemon/api.py

@@ -639,6 +639,7 @@ def create_api(
     """
 
     from pinky_daemon.config import resolve_deployment_mode
+    from pinky_daemon.net.client_identity import trusted_proxies_from_env
 
     if deployment_mode is None:
         deployment_mode = resolve_deployment_mode()
@@ -651,6 +652,9 @@ def create_api(
     # Cache on app.state for middleware/route consumers — single source of
     # truth for the rest of the #433 hardening track.
     app.state.deployment_mode = deployment_mode
+    # Trusted reverse-proxy CIDRs (#442). Read once at create_api time so the
+    # canonical client-IP resolver doesn't hit os.environ on every request.
+    app.state.trusted_proxies = trusted_proxies_from_env()
 
     # ── CORS ──────────────────────────────────────────────
     # Allow origins from env (comma-separated) or default to same-origin only.

src/pinky_daemon/net/__init__.py

@@ -0,0 +1,6 @@
+"""Network utilities for the pinky daemon.
+
+Currently houses :mod:`pinky_daemon.net.client_identity` (the canonical
+trusted-client-IP resolver introduced in #442). Future cross-cutting network
+helpers should live here too rather than being scattered across ``api.py``.
+"""