feat: complete Epic 1 production foundation

apps/admin-api/src/state.rs

@@ -1,14 +1,14 @@
 use crate::service::AdminService;
 use crank_runtime::RequestRateLimiter;
+use std::net::IpAddr;
 
 #[derive(Clone)]
 pub struct AppState {
     pub service: AdminService,
     pub api_rate_limiter: RequestRateLimiter,
-    /// Whether to trust `X-Real-IP` / `X-Forwarded-For` for client identification.
+    /// Immediate peer IPs allowed to supply `X-Real-IP` / `X-Forwarded-For`.
     ///
-    /// Only enable when the service sits behind a trusted reverse proxy that
-    /// overwrites these headers (e.g. the bundled nginx). When disabled the
-    /// real TCP peer address is used, which a client cannot spoof.
-    pub trust_forwarded_headers: bool,
+    /// Only configure reverse proxies that overwrite these headers. When the
+    /// peer is absent or not listed the real TCP peer address is used.
+    pub trusted_proxy_ips: Vec<IpAddr>,
 }