Security: fix plugin auth/access bypasses + fail-open controls

[ndreno]

Hardening of the plugin layer (security review item #7). Secure-by-default: controls that previously failed open now fail closed, with an explicit opt-out. All touched plugins build and pass their tests; the SDK + workspace pass the clippy gate.

Fixes

• SDK: new resolve_client_ip(req, trusted_proxies) — one trusted-proxy-aware client-IP resolver shared by the security middlewares (kills the per-plugin spoofable variants).
• ip-restriction: IPv4 and IPv6 (std::net::IpAddr) so an IPv6 client is no longer silently let past a denylist; X-Forwarded-For/X-Real-IP honored only behind configured trusted_proxies; fail closed on an unparseable client IP when restrictions exist.
• cors: a literal * with allow_credentials no longer allows an arbitrary origin (Fetch-spec violation); responses now reflect the validated origin with Vary: Origin (carried from on_request via context).
• rate-limit / ai-token-limit: fail closed (503) when the host limiter is unavailable by default (fail_open: true to opt out); partition by the trusted-proxy-aware client IP so rotating X-Forwarded-For can't mint fresh buckets; ai-token-limit logs (instead of silently charging 0) an unparseable token count.
• ai-prompt-guard: fail closed on an unparseable body or non-array messages (fail_open: true to opt out) so the guard can't be bypassed with a malformed body.
• dispatchers (kafka, nats, lambda, s3, http-upstream, oauth2-auth, oidc-auth, ws-upstream): clamp the host-returned read length to the buffer before slicing — removes a panic vector.
• ai-proxy: schema guidance to use secret references (env:///file://) for api_key (keys are not logged anywhere — verified).

New config (all backward-compatible, secure defaults)

Key	Plugins	Default
trusted_proxies	ip-restriction, rate-limit, ai-token-limit	[] (forwarded headers untrusted)
fail_open	rate-limit, ai-token-limit, ai-prompt-guard	false (fail closed)

Behavior changes (secure-by-default)

• Spoofed X-Forwarded-For is ignored unless the immediate peer is a configured trusted proxy.
• A rate/token limiter outage now rejects (503) instead of allowing traffic; set fail_open: true to keep the old behavior.
• ai-prompt-guard rejects (400) a body it can't inspect instead of passing it through.

Tracked privately as #7. Remaining auth/crypto items (constant-time compare, OIDC alg binding, etc.) are issue #6.