fix(security): authorize site uploads and harden tokens, media and request identity

src/lib/foundation/security.ts

@@ -2,6 +2,7 @@ import crypto from "node:crypto";
 import { cookies, headers } from "next/headers";
 import { redirect } from "next/navigation";
 import { env } from "@/env";
+import { resolveClientIp, UNKNOWN_CLIENT_IP } from "@/lib/client-ip";
 import { logger } from "@/lib/logger";
 import type { IpAddress } from "./types";
 
@@ -210,14 +211,9 @@ export function sanitizeField(
 
 export async function extractClientIpAsync(): Promise<IpAddress> {
 	try {
-		const h = await headers();
-		return (h.get("x-real-client-ip") ??
-			h.get("cf-connecting-ip") ??
-			h.get("x-forwarded-for")?.split(",")[0]?.trim() ??
-			h.get("x-real-ip") ??
-			"0.0.0.0") as IpAddress;
+		return resolveClientIp(await headers()) as IpAddress;
 	} catch {
 		logger.warn("Failed to get client IP from headers");
-		return "0.0.0.0" as IpAddress;
+		return UNKNOWN_CLIENT_IP as IpAddress;
 	}
 }