fix(security): authorize site uploads and harden tokens, media and request identity

src/lib/access-guard.ts

@@ -3,6 +3,7 @@ import { headers } from "next/headers";
 import { redirect } from "next/navigation";
 import { auth } from "@/lib/auth";
 import { unixNow } from "@/lib/bans";
+import { resolveClientIp } from "@/lib/client-ip";
 import { Ban, db } from "@/lib/db";
 import { safeRedirect } from "@/lib/foundation/security";
 import { logger } from "@/lib/logger";
@@ -26,10 +27,7 @@ function isExempt(path: string): boolean {
 export async function enforceSiteAccess(): Promise<void> {
 	const h = await headers();
 	const path = h.get("x-pathname") ?? "/";
-	const ip =
-		h.get("x-real-client-ip") ??
-		h.get("x-forwarded-for")?.split(",")[0]?.trim() ??
-		"0.0.0.0";
+	const ip = resolveClientIp(h);
 
 	void recordRequest(ip).catch(() => {});