fix(06): CR-03 replace raw X-Forwarded-For reads with get_client_ip()

Replace all instances of request.headers.get("X-Forwarded-For") in
cloud.py (connect_webdav, delete_connection) and documents.py (upload,
confirm, delete) with get_client_ip(request) from deps.utils. Add
get_client_ip import to both files. Prevents XFF spoofing in audit logs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/api/cloud.py

@@ -37,6 +37,7 @@ from config import settings
 from db.models import CloudConnection, User
 from deps.auth import get_regular_user
 from deps.db import get_db
+from deps.utils import get_client_ip
 from services.audit import write_audit_log
 from services.rate_limiting import account_limiter
 from storage.cloud_utils import encrypt_credentials, decrypt_credentials, validate_cloud_url
@@ -626,7 +627,7 @@ async def connect_webdav(
     conn = await _upsert_cloud_connection(session, current_user.id, body.provider, credentials_enc)
     await session.flush()
 
-    _ip = request.headers.get("X-Forwarded-For") or (request.client.host if request.client else None)
+    _ip = get_client_ip(request)
     await write_audit_log(
         session,
         event_type="cloud.connected",
@@ -763,7 +764,7 @@ async def delete_connection(
     from services.cloud_cache import invalidate_provider_cache  # lazy import
     invalidate_provider_cache(str(current_user.id), provider)
 
-    _ip = request.headers.get("X-Forwarded-For") or (request.client.host if request.client else None)
+    _ip = get_client_ip(request)
 
     await write_audit_log(
         session,