feat: prepare six-lesson trial backend with reliable rewards and operations

Co-authored-by: Cursor <cursoragent@cursor.com>

test/client-ip.test.ts

@@ -0,0 +1,37 @@
+import assert from 'node:assert/strict'
+import type { FastifyRequest } from 'fastify'
+import { getClientIp, resetClientIpConfigForTests } from '../src/common/http/client-ip'
+
+function mockReq(peer: string, headers: Record<string, string | undefined> = {}): FastifyRequest {
+  return {
+    socket: { remoteAddress: peer },
+    headers,
+  } as FastifyRequest
+}
+
+resetClientIpConfigForTests()
+process.env.TRUST_PROXY = 'true'
+
+const untrustedPeer = '203.0.113.50'
+const trustedPeer = '172.20.0.5'
+
+assert.equal(
+  getClientIp(mockReq(untrustedPeer, { 'x-forwarded-for': '1.2.3.4' })),
+  untrustedPeer,
+  'untrusted peer must ignore forged XFF',
+)
+
+assert.equal(
+  getClientIp(mockReq(trustedPeer, { 'x-forwarded-for': '198.51.100.10' })),
+  '198.51.100.10',
+  'trusted proxy peer may use first XFF hop',
+)
+
+delete process.env.TRUST_PROXY
+assert.equal(
+  getClientIp(mockReq(trustedPeer, { 'x-forwarded-for': '198.51.100.10' })),
+  trustedPeer,
+  'TRUST_PROXY off ignores XFF even from docker peer',
+)
+
+console.log('client-ip tests passed')