net: strip the ephemeral source port from the forwarded client IP

IIS ARR sets X-Forwarded-For to clientip:port, and the port changes every
connection. Left in, the audit log showed IP:PORT, the dashboard IP fallback
never matched a stored (portless) DashboardDefault.ipaddress, and login rate
limiting keyed per-connection instead of per-host. Add an IPv6-safe
clientip.client_ip / strip_port helper and use it in the audit log, the
dashboard resolver, and the login rate-limit key.

shopdb/core/api/dashboarddefaults.py

@@ -17,11 +17,10 @@ dashboarddefaults_bp = Blueprint('dashboarddefaults', __name__)
 
 
 def _request_ip():
-    """Caller IP, honoring a single proxy hop via X-Forwarded-For."""
-    forwarded = request.headers.get('X-Forwarded-For')
-    if forwarded:
-        return forwarded.split(',')[0].strip()
-    return request.remote_addr
+    """Caller IP for the IP fallback, port stripped so it matches a stored
+    (portless) DashboardDefault.ipaddress. ARR forwards clientip:port."""
+    from shopdb.utils.clientip import client_ip
+    return client_ip(request)
 
 
 def _serialize(default):