fix: authenticate Node client addresses

[smiggleworth]

Summary

• overwrite the reserved client-address header from the TCP socket peer
• normalize IPv4-mapped IPv6 without conflating native addresses
• export the documented CLIENT_ADDRESS_HEADER contract
• explicitly leave X-Forwarded-For untrusted and uninterpreted

Linked issues

Closes #21
Prerequisite for askrjs/destroyer#10

TDD

• Red af11bee: two real TCP requests rotate both spoofable headers and the app observes the attacker values.
• Green 7cc10e1: the shared Node conversion boundary overwrites the reserved header with socket.remoteAddress while leaving ordinary headers intact.

Security boundary and guardrails

• source: arbitrary client HTTP headers
• enforcement: IncomingMessage to Web Request conversion
• trusted value: normalized TCP socket peer or deterministic unknown
• real TCP spoof regression plus IPv4/IPv6 normalization matrix
• createNodeHandler, listen, and serve all share the guarded conversion path

Acceptance audit

• Every acceptance criterion in Expose a non-spoofable TCP peer address to Node-hosted apps #21 is checked with evidence.
• Full local release gate passes: 57 tests, lint, application/test types, declaration build, publint, and packed-artifact checks.
• Runtime dependency audit reports zero vulnerabilities.
• Exact-head hosted CI passes on Ubuntu, macOS, and Windows (run 31904861365).
• Release @askrjs/node@0.0.11 from exact squash merge 1a635e5823dc8b861f9810b479d01fe42a0b93c4 (run 31904929419).
• Clean registry-only TCP consumer proved rotated spoof headers cannot alter the peer identity and reported zero runtime vulnerabilities.

Local verification

• npm run check
• npm audit --omit=dev

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[smiggleworth]

Release closure verified:

• Publish run 31904929419 passed the full three-platform CI gate and publish job.
• Annotated tag v0.0.11 peels to squash merge 1a635e5823dc8b861f9810b479d01fe42a0b93c4, identical to main at release.
• npm reports @askrjs/node@0.0.11 with integrity sha512-2hRK6lC//JBo7hfsoemHXhMFXiHs9EpSWTU6Q+tnQ99xelgxKpNTplDZoiI+DMZWxq6HgrjEz+vIQLBj5S55mg==.
• A clean registry-only consumer sent two real TCP requests with different spoofed reserved and XFF values; both reached the app as peer 127.0.0.1, and the runtime audit reported zero vulnerabilities.