fix(06.2): WR-07 document X-Forwarded-For trust boundary in all IP extraction code

backend/api/shares.py

@@ -63,7 +63,16 @@ class SharePermissionPatch(BaseModel):
 
 
 def _ip(request: Request) -> Optional[str]:
-    """Extract best-effort client IP from request (behind proxy or direct)."""
+    """Extract best-effort client IP from request (behind proxy or direct).
+
+    TRUST BOUNDARY: X-Forwarded-For is a client-controlled header and can be
+    forged by any caller. This value is used for forensic audit logging only —
+    not for authentication or access control decisions. In production, deploy
+    behind a trusted reverse proxy (e.g. nginx with
+    `proxy_set_header X-Forwarded-For $remote_addr;`) which overwrites this
+    header with the real remote IP before it reaches FastAPI, or use a
+    trusted-proxy middleware that validates the source CIDR.
+    """
     return request.headers.get("X-Forwarded-For") or (
         request.client.host if request.client else None
     )