Deploy main eacf1e7 to prod

Replaces #559, which conflicted.

Model: opus-5-5

internal/middleware/loginguard.go

@@ -108,10 +108,10 @@ type failureWindow struct {
 //
 // A limiter that spends budget on arrival cannot protect a
 // single-admin product: behind the reverse proxy the deployment
-// requires, with TRUSTED_PROXIES unset, every client keys on the
-// proxy, so a stranger trickling five POSTs a minute keeps the one
-// bucket full and the operator's own correct password is answered 429
-// forever. There is no second administrative path.
+// requires, when TRUSTED_PROXIES does not cover it, every client
+// keys on the proxy, so a stranger trickling five POSTs a minute
+// keeps the one bucket full and the operator's own correct password
+// is answered 429 forever. There is no second administrative path.
 //
 // So budget is spent only by a FAILED verification. A correct
 // password is never throttled, whatever the counters say, which is
@@ -385,6 +385,8 @@ func (m *Middleware) RecordLoginFailure(
 			"path", logfield.Truncate(
 				r.URL.Path, logfield.MaxBytes,
 			),
+			"remoteIP", RemoteIP(r),
+			"clientIP", ClientIP(r),
 		)
 	}