fix(gateway): forward the real client IP to the backend on every call

The backend recorded 172.19.0.9 — the gateway's own docker connection address — as
the client IP for all users: the account's last-login IP shown in the admin console,
and it never reached the backend access log. The gateway forwarded the client IP as
X-Forwarded-For only on chat/feedback calls; every other backend call (including the
profile fetch that stamps last_login_ip) sent none, so the backend fell back to the
peer address.

Carry the client IP on the request context (WithClientIP, mirroring WithPlatform) and
set it once per request in the Connect edge, so the backend client injects
X-Forwarded-For on every downstream REST call. Also add the resolved client IP to the
backend access log.

Test: WithClientIP rides a non-chat call (Profile) as X-Forwarded-For, and is absent
when no IP is set. Docs updated (ARCHITECTURE gateway↔backend + edge).

gateway/internal/backendclient/client_test.go

@@ -122,3 +122,44 @@ func TestXPlatformInjection(t *testing.T) {
 		}
 	})
 }
+
+// TestXForwardedForInjection verifies the client IP carried on the context (WithClientIP) rides every
+// backend call as X-Forwarded-For — not just chat/feedback, which pass it explicitly — so the backend
+// records the real caller (e.g. the account's last-login IP on the profile fetch) rather than the
+// gateway's own connection. Absent when no client IP is set.
+func TestXForwardedForInjection(t *testing.T) {
+	var gotXFF string
+	var hadHeader bool
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotXFF = r.Header.Get("X-Forwarded-For")
+		_, hadHeader = r.Header["X-Forwarded-For"]
+		_, _ = w.Write([]byte(`{}`))
+	}))
+	defer srv.Close()
+
+	c, err := backendclient.New(srv.URL, "localhost:9090", 2*time.Second)
+	if err != nil {
+		t.Fatalf("backendclient: %v", err)
+	}
+	defer func() { _ = c.Close() }()
+
+	t.Run("client IP on ctx rides a non-chat call", func(t *testing.T) {
+		ctx := backendclient.WithClientIP(context.Background(), "203.0.113.7")
+		if _, err := c.Profile(ctx, "user-1"); err != nil {
+			t.Fatalf("Profile: %v", err)
+		}
+		if gotXFF != "203.0.113.7" {
+			t.Fatalf("X-Forwarded-For = %q, want 203.0.113.7", gotXFF)
+		}
+	})
+
+	t.Run("no client IP omits the header", func(t *testing.T) {
+		hadHeader = true
+		if _, err := c.Profile(context.Background(), "user-1"); err != nil {
+			t.Fatalf("Profile: %v", err)
+		}
+		if hadHeader {
+			t.Fatal("X-Forwarded-For must be absent when no client IP is set")
+		}
+	})
+}