Initial vibeproxy implementation

Self-contained HTTP/HTTPS/TCP/UDP reverse proxy manager written in Go,
with SQLite storage, a Bootstrap 5 admin UI (Go templates, no JS
framework), and a REST API under /api/v1.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QTXFrNP1imCW7jtfL5SZrw

internal/proxy/clientip.go

@@ -0,0 +1,43 @@
+package proxy
+
+import (
+	"net"
+	"net/http"
+	"strings"
+
+	"github.com/owen/vibeproxy/internal/runtime"
+)
+
+// ClientIP returns the real client IP for r. If the immediate peer is a
+// trusted proxy (per snap.TrustedProxies), the right-most untrusted entry
+// in X-Forwarded-For is used; otherwise X-Forwarded-For is ignored
+// entirely and the TCP peer address is authoritative. This is the only
+// place XFF is trusted, and only for configured networks.
+func ClientIP(r *http.Request, snap *runtime.Snapshot) string {
+	peerIP, _, err := net.SplitHostPort(r.RemoteAddr)
+	if err != nil {
+		peerIP = r.RemoteAddr
+	}
+	ip := net.ParseIP(peerIP)
+	if ip == nil || snap == nil || !snap.IsTrustedProxy(ip) {
+		return peerIP
+	}
+
+	xff := r.Header.Get("X-Forwarded-For")
+	if xff == "" {
+		return peerIP
+	}
+	parts := strings.Split(xff, ",")
+	for i := len(parts) - 1; i >= 0; i-- {
+		candidate := strings.TrimSpace(parts[i])
+		cip := net.ParseIP(candidate)
+		if cip == nil {
+			continue
+		}
+		if snap.IsTrustedProxy(cip) {
+			continue // still a known proxy hop, keep walking left
+		}
+		return candidate
+	}
+	return peerIP
+}