feat(audit): capture IP address, make TRUST_PROXY configurable

apps/api/src/lib/audit.ts

@@ -39,8 +39,9 @@ export async function auditLog(
   logger: FastifyBaseLogger,
   event: AuditEvent,
   details: Record<string, unknown> = {},
+  ip: string | null = null,
 ): Promise<void> {
-  logger.info({ audit: true, event, ...details }, `[AUDIT] ${event}`);
+  logger.info({ audit: true, event, ip, ...details }, `[AUDIT] ${event}`);
 
   const actorId = (details.userId as string) ?? (details.adminId as string) ?? null;
   const actorUsername = (details.username as string) ?? (details.newUsername as string) ?? "system";
@@ -56,7 +57,7 @@ export async function auditLog(
       targetType,
       targetId,
       details,
-      ipAddress: null,
+      ipAddress: ip,
     });
   } catch {
     logger.warn({ event }, "Failed to write audit log to DB");

apps/api/src/lib/env.ts

@@ -58,10 +58,7 @@ const envSchema = z
     LIBREOFFICE_TIMEOUT_S: z.coerce.number().default(120),
     SESSION_DURATION_HOURS: z.coerce.number().default(168),
     LOGIN_ATTEMPT_LIMIT: z.coerce.number().default(30),
-    TRUST_PROXY: z
-      .enum(["true", "false"])
-      .default("false")
-      .transform((v) => v === "true"),
+    TRUST_PROXY: z.string().default("false"),
     OIDC_ENABLED: z
       .enum(["true", "false"])
       .default("false")