feat(installer): bundle URL Rewrite, ask where client IPs come from, verify installs

IIS does not set X-Forwarded-For on its own and HttpPlatformHandler connects
from loopback, so without a rewrite rule every client reads as 127.0.0.1. The
GE-Enforce IP allowlist, the dashboard visitor-location lookup and per-host
login rate limiting all stop working, silently. The rule needed URL Rewrite,
which the installer told operators to download - from an air-gapped server.

URL Rewrite now ships in the bundle, and the wizard asks which case applies,
because the two answers are mutually exclusive. Directly exposed: install it and
set X-Forwarded-For from REMOTE_ADDR, which is what stops a client spoofing its
own. Behind a proxy: leave the rule off, since REMOTE_ADDR is the proxy and
applying it would discard the real client IP.

The rule is enabled by deleting two explicit marker lines rather than by a regex
over the surrounding comment, so editing that prose cannot silently disable it.

An existing web.config is no longer overwritten. It is the one file on a server
that legitimately carries hand-edits, and replacing it reverted them without a
word - on a server where the X-Forwarded-For rule had been enabled by hand, that
alone would have turned the GE-Enforce IP allowlist off. The installer reports
what it found instead.

pip now runs with --require-hashes and --only-binary=:all:. Hash-checking is
requested explicitly rather than inferred from the lockfile, so shipping an
unhashed requirements.txt fails loudly instead of quietly dropping the check.

shopdb-admin.ps1 gains a verify command: which bundle this server was installed
from, and whether the installed packages still match what shipped.

The .iss states its compiler floor. WizardStyle uses the built-in windows11
custom style, which needs Inno Setup 6.6.0; older compilers now fail with that
sentence rather than 'WizardStyle is invalid'.

deploy/windows/web.config

@@ -49,16 +49,29 @@
     </httpPlatform>
 
     <!--
-      OPTIONAL: forward the real client IP so audit logs and the kiosk
-      visitor-location feature (IP -> business unit) see the caller, not the
-      loopback that HttpPlatformHandler connects from.
+      Forward the real client IP, so the audit log, the kiosk visitor-location
+      feature (IP -> business unit), the GE-Enforce IP allowlist and per-host
+      login rate limiting all see the caller rather than the loopback address
+      HttpPlatformHandler connects from.
 
-      This block is COMMENTED OUT by default because it needs the URL Rewrite
-      module; with it uncommented but URL Rewrite not installed, IIS returns
-      HTTP 500.19 ("configuration section not well-formed / cannot be read").
-      Install URL Rewrite (https://www.iis.net/downloads/microsoft/url-rewrite)
-      and then uncomment the <rewrite> block below to enable it.
+      IIS does not set X-Forwarded-For on its own. Without the rule below there
+      is no such header at all, and every client looks like 127.0.0.1 - so the
+      allowlist and the visitor-location lookup silently stop working.
 
+      ONLY CORRECT WHEN IIS IS DIRECTLY EXPOSED. It overwrites the header with
+      REMOTE_ADDR, which is what stops a client spoofing its own X-Forwarded-For.
+      Behind a reverse proxy (ARR, a load balancer) REMOTE_ADDR is the PROXY, so
+      this rule would destroy the real client IP - there, leave it disabled and
+      let the proxy set the header.
+
+      It ships DISABLED because it needs the URL Rewrite module; enabled without
+      it, IIS returns HTTP 500.19 ("configuration section not well-formed").
+
+      The installer handles both: -ClientIpSource direct installs URL Rewrite
+      from the bundle and enables this; -ClientIpSource proxy leaves it alone.
+      By hand: install URL Rewrite, then delete the two marker lines below.
+    -->
+    <!-- SHOPDB-CLIENTIP-BEGIN
     <rewrite>
       <allowedServerVariables>
         <add name="HTTP_X_FORWARDED_FOR" />
@@ -73,7 +86,7 @@
         </rule>
       </rules>
     </rewrite>
-    -->
+    SHOPDB-CLIENTIP-END -->
 
   </system.webServer>