fix(19.7): RA-IN-02 stream bearer re-checks carry the client address

The stateful GET stream and the stateless subscriptions/listen stream
capture the client address when they open and resolve every periodic
re-check with towel.WithClientIP, as the bearer middleware does, so a
failing re-check (a revoked admin token, for example) is logged with the
remote address. TestStreamRecheckClientIP records the address the verifier
sees on every verification of both streams.

modules/pier/stateless.go

@@ -11,6 +11,7 @@ import (
 	"sync"
 	"time"
 
+	"git.golem15.com/golem15/summercms/modules/towel"
 	"github.com/modelcontextprotocol/go-sdk/mcp"
 )
 
@@ -125,6 +126,7 @@ func (sp *statelessPath) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	ctx, cancel := context.WithCancel(r.Context())
 	defer cancel()
 	raw := bearerOf(r)
+	ip := sp.p.clientIP(r)
 	go func() {
 		ticker := time.NewTicker(sp.p.recheck)
 		defer ticker.Stop()
@@ -133,7 +135,7 @@ func (sp *statelessPath) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 			case <-ctx.Done():
 				return
 			case <-ticker.C:
-				cur, err := sp.p.identities.resolve(ctx, raw)
+				cur, err := sp.p.identities.resolve(towel.WithClientIP(ctx, ip), raw)
 				if err != nil || cur.Binding != id.Binding {
 					logSession(logger(), "stream_closed", "", id.Binding)
 					cancel()