feat: dev-only peer IP + continent diagnostic log

[mikhail-dcl]

Summary

Diagnostic for the question "does the client's real source IP survive the AWS ingress?" — each connecting ENet peer's observed IP and geo-resolved continent are logged at connect, on dev only:

Peer IP diagnostic: 203.0.113.7:54321 -> region EUROPE (slot=3, peerIndex=17).

Compare the logged IP against the client's actual public IP: if it shows an AWS address instead, the ingress path (VPN/tunnel/relay) is rewriting sources — which also matters beyond metrics, since the per-IP pre-auth cap assumes source fidelity.

How it's gated

No config boolean — the log lives on a dedicated logger category Pulse.Diagnostics.PeerIp (EventId 9101 PeerIpDiagnostic), controlled entirely by standard logging config (per-EventId filtering isn't supported by MEL; a category is the idiomatic equivalent):

Surface	Setting
appsettings.json (prod)	"Pulse.Diagnostics": "None" — explicit pin; stays off even if Default is raised during an incident
appsettings.Development.json	Information
docker-compose.debug.yml	Logging__LogLevel__Pulse.Diagnostics: Information
Manual Deploy workflow	Information when deployment-environment == 'dev', else None
Dockerfile.dev-debug	baked ENV (image only ever deploys to dev)

The IsEnabled guard skips the native Peer.IP call entirely when the category is off; the log fires only after admission checks (refused peers are never logged). Peer IPs are personal data — hence category-gated, default-off, prod-pinned.

The prefix-rule semantics (Pulse.Diagnostics governs the child category; None beats a raised Default; __ env translation with the dotted segment) were verified empirically against MEL, not assumed.

Testing

• Full suite 449/449 green; build clean.
• Known follow-up (pre-existing, out of scope): five hardening log sites already emit peer IPs at Warning level in prod — flagged separately for a hash/keep decision.

🤖 Generated with Claude Code