fix(security): authorize site uploads and harden tokens, media and request identity

src/lib/services/staff-activity.ts

@@ -1,4 +1,5 @@
 import { headers } from "next/headers";
+import { resolveClientIp, UNKNOWN_CLIENT_IP } from "@/lib/client-ip";
 import { db, StaffActivities } from "@/lib/db";
 
 /**
@@ -13,15 +14,11 @@ export async function logStaffActivity(opts: {
 	targetId?: number;
 }): Promise<void> {
 	try {
-		let ip: string | null = null;
+		let ip = UNKNOWN_CLIENT_IP;
 		try {
-			const h = await headers();
-			ip =
-				h.get("x-real-client-ip") ??
-				h.get("x-forwarded-for")?.split(",")[0]?.trim() ??
-				null;
+			ip = resolveClientIp(await headers());
 		} catch {
-			ip = null;
+			// Some background actions have no request context.
 		}
 		await db.insert(StaffActivities).values({
 			userId: BigInt(opts.staffId),