add token revoke and panic lockdown endpoints with security logging

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/servers/api/auth/client-ip.ts

@@ -0,0 +1,9 @@
+import type { Context } from 'hono';
+
+// Best-effort client IP for audit logging. Behind a reverse proxy the real address is in
+// x-forwarded-for (first hop); fall back to x-real-ip, then "unknown".
+export const clientIp = (ctx: Context): string => {
+  const xff = ctx.req.header('x-forwarded-for');
+  if (xff) return xff.split(',')[0]?.trim() || 'unknown';
+  return ctx.req.header('x-real-ip') || 'unknown';
+};