feat: replace inline IP resolution with centralized client_ip utility across routers and audit

Consolidate scattered `X-Real-IP` / `request.client.host` fallback logic into the single `client_ip()` helper from `utils`, reducing duplication in the rate limiter middleware, project file zip routes, tools shared module, and audit record builder. Also refactor three admin endpoints (`/ai-usage/data`, `/analytics`, `/users/{uid}/ai-usage`) to use the existing `require_admin()` guard instead of repeating manual auth checks, and remove now-unused `get_current_user`/`is_admin` imports from those modules.

devplacepy/services/devii/actions/dispatcher.py

@@ -347,16 +347,19 @@ class Dispatcher:
         logger.info("Dispatch %s args=%s", name, list(arguments))
         try:
             if action.requires_auth and not self._client.authenticated:
+                self._audit_denied(name, "authentication required", arguments)
                 raise AuthRequiredError(
                     "Not authenticated. Ask the user for credentials and call the login tool first.",
                     tool=name,
                 )
             if action.requires_admin and not self._is_admin:
+                self._audit_denied(name, "administrator access required", arguments)
                 raise AuthRequiredError(
                     "This information is restricted to administrators.",
                     tool=name,
                 )
             if action.requires_primary_admin and not self._is_primary_admin:
+                self._audit_denied(name, "primary administrator access required", arguments)
                 raise AuthRequiredError(
                     "This tool is restricted to the primary administrator.",
                     tool=name,
@@ -384,6 +387,22 @@ class Dispatcher:
             logger.exception("Dispatch %s crashed", name)
             return unexpected_result(exc)
 
+    def _audit_denied(self, name: str, reason: str, arguments: dict[str, Any]) -> None:
+        from devplacepy.services.audit import record as audit
+
+        actor_kind = "user" if self._owner_kind == "user" else self._owner_kind
+        audit.record_system(
+            "security.authz.denied",
+            actor_kind=actor_kind,
+            actor_uid=self._owner_id if self._owner_kind == "user" else None,
+            actor_role="admin" if self._is_admin else (actor_kind if actor_kind != "user" else "member"),
+            origin="devii",
+            via_agent=1,
+            result="denied",
+            summary=f"Devii denied {name}: {reason}",
+            metadata={"tool": name, "reason": reason, "args": _safe_args(arguments)},
+        )
+
     def _audit_mechanic(self, action: Action, arguments: dict[str, Any]) -> None:
         from devplacepy.services.audit import record as audit