Audit Whoami Endpoint

Return the IP the backend captured for THIS request + the forwarding headers it was derived from.

Use this to verify the X-Forwarded-For / cf-connecting-ip fallback chain is picking up the real client IP rather than Railway's CGNAT peer. When detected_ip matches your actual public IP (check https://ifconfig.me), the fix is live and future sessions will resolve a city.