from fastapi import Request


def client_ip(request: Request) -> str:
    """Real client IP as resolved by the frontend nginx (real_ip module).

    X-Forwarded-For is client-controlled and must not be trusted here; nginx
    sets X-Real-IP from $remote_addr after walking past trusted proxies.
    """
    return request.headers.get("X-Real-IP") or (request.client.host if request.client else "unknown")