fix(api): use the Cloudflare client IP for allowed IPs and audit logs

Closes #12301

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Http/Controllers/Webhook/Concerns/ThrottlesManualWebhookFailures.php

@@ -51,7 +51,7 @@ trait ThrottlesManualWebhookFailures
     /**
      * The connection address of the client. X-Forwarded-For is ignored, since
      * any client can set it and rotate it to get a new bucket. On cloud, a
-     * valid CF-Connecting-IP is used, as in auth_rate_limit_ip().
+     * valid CF-Connecting-IP is used.
      */
     protected function manualWebhookFailureClientAddress(Request $request): string
     {

app/Http/Middleware/ApiIpAllowed.php

@@ -22,7 +22,7 @@ class ApiIpAllowed
 
         $allowedIps = array_filter(array_map('trim', explode(',', $allowedIps)));
 
-        if (! empty($allowedIps) && ! checkIPAgainstAllowlist($request->ip(), $allowedIps)) {
+        if (! empty($allowedIps) && ! checkIPAgainstAllowlist(client_ip($request), $allowedIps)) {
             return response()->json(['success' => true, 'message' => 'You are not allowed to access the API.'], 403);
         }