net: strip the ephemeral source port from the forwarded client IP

IIS ARR sets X-Forwarded-For to clientip:port, and the port changes every
connection. Left in, the audit log showed IP:PORT, the dashboard IP fallback
never matched a stored (portless) DashboardDefault.ipaddress, and login rate
limiting keyed per-connection instead of per-host. Add an IPv6-safe
clientip.client_ip / strip_port helper and use it in the audit log, the
dashboard resolver, and the login rate-limit key.

shopdb/core/models/auditlog.py

@@ -117,10 +117,9 @@ class AuditLog(db.Model):
         useragent = None
 
         if request_obj:
-            # Handle proxy forwarding
-            ipaddress = request_obj.headers.get('X-Forwarded-For', request_obj.remote_addr)
-            if ipaddress and ',' in ipaddress:
-                ipaddress = ipaddress.split(',')[0].strip()
+            # First-hop client IP, port stripped (ARR forwards clientip:port).
+            from shopdb.utils.clientip import client_ip
+            ipaddress = client_ip(request_obj)
             useragent = request_obj.headers.get('User-Agent', '')[:255]
 
         entry = cls(