net: strip the ephemeral source port from the forwarded client IP

IIS ARR sets X-Forwarded-For to clientip:port, and the port changes every
connection. Left in, the audit log showed IP:PORT, the dashboard IP fallback
never matched a stored (portless) DashboardDefault.ipaddress, and login rate
limiting keyed per-connection instead of per-host. Add an IPv6-safe
clientip.client_ip / strip_port helper and use it in the audit log, the
dashboard resolver, and the login rate-limit key.

shopdb/core/api/auth.py

@@ -26,11 +26,10 @@ LOCKOUT_MINUTES = 15
 
 
 def _login_ip():
-    """Caller IP for rate limiting, honoring the first X-Forwarded-For hop."""
-    forwarded = request.headers.get('X-Forwarded-For')
-    if forwarded:
-        return forwarded.split(',')[0].strip()
-    return request.remote_addr or 'unknown'
+    """Caller IP for rate limiting, port stripped so the key is per-host, not
+    per-connection (ARR forwards clientip:port with an ephemeral port)."""
+    from shopdb.utils.clientip import client_ip
+    return client_ip(request) or 'unknown'
 
 
 def _login_ratelimited():