fix(audit): record the trusted-proxy-aware client IP, never raw X-Forwarded-For (#877)

[alex-dembele]

Closes #877

AuditService.LogFiber replaced c.IP() with the raw X-Forwarded-For header whenever the header was there, so any client could write the IP of its choice into auth_audit_logs (login, refresh, MFA, SSO events). It now records c.IP() only. Fiber resolves the forwarded address in c.IP() only when the peer is a configured trusted proxy (F-04).

The same raw read was in MFARateLimit and OAuthRateLimit (internal/middleware/auth.go). Neither is mounted anywhere today, but both now use c.IP() too, so the defect can't come back when someone wires them.

Verification

• TestLogFiber_UntrustedPeerCannotChooseTheAuditedIP: fails on master (the audit row recorded the client-supplied X-Forwarded-For), passes here.
• TestLogFiber_TrustedProxyForwardedAddressIsKept: passes (a trusted proxy's forwarded address is still recorded).
• grep -rn 'Get("X-Forwarded-For")' --include=*.go backend | grep -v _test → 0 lines.
• Full gate go build ./... && go vet ./... && go test ./... -race: BUILD_OK · VET_OK · TEST_OK, 80 packages ok, 0 FAIL. Note: master currently doesn't build (fix(auth): master does not build — the #866 merge kept the unsigned SAML ACS body #881), so this gate ran with fix(auth): master does not build — restore the #866 SAML handler (#881) #882's commit temporarily applied on top. That commit isn't part of this PR.

Honest remainders

• Merge fix(auth): master does not build — restore the #866 SAML handler (#881) #882 first: until then, this branch inherits master's build break in internal/handler.
• Audit rows written before this fix may carry a client-chosen IP. There's no way to tell which ones.