feat: replace inline IP resolution with centralized client_ip utility across routers and audit

Consolidate scattered `X-Real-IP` / `request.client.host` fallback logic into the single `client_ip()` helper from `utils`, reducing duplication in the rate limiter middleware, project file zip routes, tools shared module, and audit record builder. Also refactor three admin endpoints (`/ai-usage/data`, `/analytics`, `/users/{uid}/ai-usage`) to use the existing `require_admin()` guard instead of repeating manual auth checks, and remove now-unused `get_current_user`/`is_admin` imports from those modules.

devplacepy/services/audit/record.py

@@ -4,7 +4,7 @@ import json
 import logging
 from typing import Any, Optional
 
-from devplacepy.utils import strip_html, generate_uid
+from devplacepy.utils import strip_html, generate_uid, client_ip
 from devplacepy.services.audit import store
 from devplacepy.services.audit.categories import category_for
 from devplacepy.services.background import background
@@ -131,8 +131,7 @@ def _request_fields(request) -> dict:
         fields["request_method"] = getattr(request, "method", None)
         url = getattr(request, "url", None)
         fields["request_path"] = url.path if url is not None else None
-        client = getattr(request, "client", None)
-        fields["actor_ip"] = client.host if client is not None else None
+        fields["actor_ip"] = client_ip(request, default=None)
         headers = getattr(request, "headers", None)
         if headers is not None:
             fields["user_agent"] = headers.get("user-agent")