Add Current IP and visitor exclusion use inconsistent client IP sources #40

Problem

The IP settings UI saves REMOTE_ADDR, while tracking prefers the entire HTTP_X_FORWARDED_FOR header. A different forwarded value, or a comma-separated proxy chain, prevents the saved address from matching. Forwarded headers are also trusted without validating the proxy.

Reproduction

1. Behind a reverse proxy, use Add Current IP, save, then revisit the site from the same browser.
2. Inspect whether tracking is suppressed by the IP rule.
3. For a controlled proxy-chain case, use an exclusion of 203.0.113.10 and X-Forwarded-For: 203.0.113.10, 10.0.0.1.

Actual: the live same-browser visit was excluded by its user role rather than its saved IP; the anonymous visit still received the tracking script. The controlled chain never matches the individual address.
Expected: the UI and tracking use the same validated client-IP policy.

Evidence

Reproduced with plugin 1.109. The live request's exact forwarded header was not captured, so its precise proxy chain remains unverified.

src/TrackingRules.php:16-22 compares the entire forwarded header; src/Settings/Blocks/Fields/IpList.php:41 displays REMOTE_ADDR.

Acceptance

Share one IP resolver between the UI and tracking. Do not trust arbitrary forwarded headers; provide a documented way for trusted proxy deployments to supply a validated address. Cover direct requests, forwarded headers, malformed input, and address normalization.