1. Security: Replace insecure extractRemoteIP() in audit service with
middleware.RealIP() which validates trusted proxies before trusting
X-Real-IP/X-Forwarded-For headers. Export RealIP from middleware.
Update audit tests to verify anti-spoofing behavior.
2. Audit coverage: Add audit instrumentation to all 9 handlers that
had dead action constants: HandleEnvVarSave, HandleLabelAdd,
HandleLabelEdit, HandleLabelDelete, HandleVolumeAdd, HandleVolumeEdit,
HandleVolumeDelete, HandlePortAdd, HandlePortDelete.
3. README: Fix API path from /api/audit to /api/v1/audit.
4. README: Fix duplicate numbering in DI order section (items 10-11
were listed twice, now correctly numbered 10-16).
