feat: replace inline IP resolution with centralized client_ip utility across routers and audit

Consolidate scattered `X-Real-IP` / `request.client.host` fallback logic into the single `client_ip()` helper from `utils`, reducing duplication in the rate limiter middleware, project file zip routes, tools shared module, and audit record builder. Also refactor three admin endpoints (`/ai-usage/data`, `/analytics`, `/users/{uid}/ai-usage`) to use the existing `require_admin()` guard instead of repeating manual auth checks, and remove now-unused `get_current_user`/`is_admin` imports from those modules.

devplacepy/routers/admin/users.py

@@ -15,8 +15,6 @@ from devplacepy.utils import (
     require_admin,
     hash_password_async,
     clear_user_cache,
-    get_current_user,
-    is_admin,
 )
 from devplacepy.seo import base_seo_context, site_url, website_schema
 from devplacepy.responses import respond, action_result
@@ -56,11 +54,7 @@ def _deny_senior(request: Request, admin: dict, uid: str, target: dict, event_ke
 
 @router.get("/users/{uid}/ai-usage")
 async def admin_user_ai_usage(request: Request, uid: str, hours: int = 24):
-    user = get_current_user(request)
-    if not user:
-        return JSONResponse({"error": "Authentication required"}, status_code=401)
-    if not is_admin(user):
-        return JSONResponse({"error": "Admin access required"}, status_code=403)
+    require_admin(request)
     service = service_manager.get_service("openai")
     pricing = pricing_from_cfg(service.get_config()) if service is not None else None
     usage = build_user_usage(uid, hours=hours, pricing=pricing)