fix(security): authorize site uploads and harden tokens, media and request identity

src/lib/rate-limit.ts

@@ -1,4 +1,5 @@
 import { headers } from "next/headers";
+import { resolveClientIp, UNKNOWN_CLIENT_IP } from "@/lib/client-ip";
 import { logger } from "@/lib/logger";
 import { redis } from "@/lib/redis";
 
@@ -89,15 +90,8 @@ export async function rateLimit(
 
 export async function clientIp(): Promise<string> {
 	try {
-		const h = await headers();
-		return (
-			h.get("x-real-client-ip") ??
-			h.get("cf-connecting-ip") ??
-			h.get("x-forwarded-for")?.split(",")[0]?.trim() ??
-			h.get("x-real-ip") ??
-			"0.0.0.0"
-		);
+		return resolveClientIp(await headers());
 	} catch {
-		return "0.0.0.0";
+		return UNKNOWN_CLIENT_IP;
 	}
 }