Axum ClientInfo #92

Description

Axum already captures the direct socket peer: Axum peer conversion converts ConnectInfo into Axum request context. The remaining ClientInfo work is portable exposure and a checked effective reader derived from forwarding headers only under an explicit trusted-proxy policy. Main does not implement an X-Forwarded-For trust parser here.

Steps to reproduce

1. Inspect Axum request conversion and AxumRequestContext.
2. Observe the direct peer captured from ConnectInfo.
3. Look for a shared ClientInfo mapping and explicit policy for accepting X-Forwarded-For assertions.

Expected behavior

Handlers distinguish the direct peer from a validated effective reader, and raw client-supplied forwarding headers cannot override peer identity.

Impact

Reverse-proxy deployments need portable reader metadata without trusting spoofable headers.

Proposed fix

Reuse the checked-ingress implementation tracked by #397 / PR #409 and map its facts/provenance into #89. Preserve peer fallback and explicit unknown states; do not add a second forwarding-header parser.

Done when

• Direct peer metadata remains available through the shared contract.
• Forwarded readers require explicit trusted-proxy policy, with documented chain/provenance behavior.
• Direct-client spoofing, malformed/duplicate headers, untrusted peers and IPv4/IPv6 are covered.

Related

Parent #88; story #89; checked native ingress #397. PR #409 is the related open implementation; Geo work PR #439 and PR #453 builds on native facts but does not by itself close this task.