security(audit): the auth audit trail records a client-chosen IP from raw X-Forwarded-For #877

Problem

AuditService.LogFiber (backend/internal/auth/audit.go) records the client IP like this:

ip := c.IP()
if xff := c.Get("X-Forwarded-For"); xff != "" {
    ip = xff
}

c.IP() already resolves the forwarded header, and only when the peer is a configured trusted proxy (middleware.TrustedProxies, EnableTrustedProxyCheck). The raw read overrides that. Any client can write any value it likes into the ip column of auth_audit_logs for every login, refresh, MFA and SSO event, so an attacker can hide their address or blame someone else's. The rate limiter fixed the same pattern under audit finding F-04; the audit trail was left behind.

Also, the column is varchar(45), so a long multi-hop header (a, b, c) can fail the insert. Audit writes are best-effort (_ =), so the event is then lost without a trace.

Acceptance criteria

1. LogFiber records c.IP() only.
2. Test: a request from an untrusted peer that sends X-Forwarded-For: 203.0.113.9 is audited with the peer address, not 203.0.113.9.
3. Test: behind a trusted proxy, the forwarded client address is recorded (this is c.IP()'s own behaviour; the test proves it is not lost).
4. No other X-Forwarded-For read is left in backend/internal/auth. A grep is pasted in the PR.

Definition of Done

• go build ./... && go vet ./... && go test ./... -race green, output pasted.
• Progress comment in the CLAUDE.md format; PR with Closes.