Promote the 2026-08-30 review security fixes and supplies ordering to main

shopdb/api/__init__.py

@@ -104,6 +104,12 @@ def collector_authorized(pluginname: str):
 # as script in this origin - see shopdb/utils/uploads.py.
 from shopdb.utils.uploads import send_upload, harden_upload_response
 
+# Caller IP for rate limiting and audit. On the surface so a plugin does not
+# reimplement it: the obvious hand-rolled version reads X-Forwarded-For, which
+# the caller supplies, so a rate limit keyed on it can be rotated away to
+# nothing. See shopdb/utils/clientip.py.
+from shopdb.utils.clientip import client_ip, strip_port
+
 # Import-mode helpers: preserve legacy timestamps during a bulk data import
 from shopdb.utils.import_mode import (
     apply_import_timestamps,
@@ -346,6 +352,8 @@ __all__ = [
     # Serving uploads
     'send_upload',
     'harden_upload_response',
+    'client_ip',
+    'strip_port',
     # Import-mode helpers
     'apply_import_timestamps',
     'import_mode_active',