Fix migrate lock scope and stop RealIP from bypassing proxy trust.

Hold a session advisory lock for the full migration apply path, and remove Chi RealIP so clientIP can validate the TCP peer before walking X-Forwarded-For.

internal/web/server.go

@@ -148,9 +148,9 @@ func New(st store.Store, sessionStore scs.Store, templateFS fs.FS, staticFS fs.F
 func (s *Server) Handler() http.Handler {
 	r := chi.NewRouter()
 	r.Use(middleware.RequestID)
-	if len(s.cfg.TrustedProxies) > 0 {
-		r.Use(middleware.RealIP)
-	}
+	// Do not use middleware.RealIP: it rewrites RemoteAddr from client-controlled
+	// forwarding headers before clientIP can validate the TCP peer against
+	// TrustedProxies. clientIP walks X-Forwarded-For itself when the peer is trusted.
 	r.Use(middleware.Logger)
 	r.Use(middleware.Recoverer)
 	r.Use(func(next http.Handler) http.Handler {