fix: address review findings for observability PR

1. Security: Replace insecure extractRemoteIP() in audit service with
   middleware.RealIP() which validates trusted proxies before trusting
   X-Real-IP/X-Forwarded-For headers. Export RealIP from middleware.
   Update audit tests to verify anti-spoofing behavior.

2. Audit coverage: Add audit instrumentation to all 9 handlers that
   had dead action constants: HandleEnvVarSave, HandleLabelAdd,
   HandleLabelEdit, HandleLabelDelete, HandleVolumeAdd, HandleVolumeEdit,
   HandleVolumeDelete, HandlePortAdd, HandlePortDelete.

3. README: Fix API path from /api/audit to /api/v1/audit.

4. README: Fix duplicate numbering in DI order section (items 10-11
   were listed twice, now correctly numbered 10-16).

internal/models/models_test.go

@@ -870,6 +870,8 @@ func TestAppResourceLimits(t *testing.T) { //nolint:funlen // integration test w
 		assert.False(t, found.CPULimit.Valid)
 		assert.False(t, found.MemoryLimit.Valid)
 	})
+}
+
 // AuditEntry Tests.
 
 func TestAuditEntryCreateAndFind(t *testing.T) {