Caller facts: trustworthy address, scoped session header, unstrippable evidence

Goal: the caller facts on audit rows can be trusted. The shown address is the one our ALB saw. The console session header never leaks to other origins. A tenant cannot erase its own evidence. Carries draft 7916 (low-severity follow-ups from Task 7873's security review, PRs #6214 and #6226). 1. Store the ALB's own right-most `X-Forwarded-For` hop in its own field (e.g. `client_ip`). Show it as "Address" on the Audit event page, and label the rest of the chain as client-declared. 2. `tools/console_cdp.cjs` sends `X-Jaah-Session` to every origin through `Network.setExtraHTTPHeaders`. Scope it to the console's own origin, for example with `Fetch.enable` and a `requestPaused` filter. 3. `request_caller.bound` blanks caller facts whenever an `X-Jaah-Act-As` header is present. Key it on the resolved act-as state instead. Out of scope: who may press Run; lockout policy; the CI trust rule. Done means: - An api test shows `client_ip` holds the ALB hop when a padded chain is sent. - A test shows `console_cdp.cjs` adds the header only to console-origin requests. - An api test shows a non-operator sending `X-Jaah-Act-As` still has caller facts on its `task:run` row. Required checks: ./dc check full

client_ip (ALB hop) stored and shown as Address; cdp session header scoped to console origin; act-as withholding keyed on guard's resolved state (fail closed if unresolved). Quick gate + tests green, review lanes pass; PR #6234 queued to lane. Draft #7977 filed.