Client IP tracking and visibility for authentication and login auditing

## Background

Backend.AI currently has limited visibility into the originating client IP for authentication events and active sessions. To support security auditing, anomaly detection, and "where am I currently logged in from / revoke all sessions originating from IP X" workflows, the manager needs to capture and expose the client IP across the login lifecycle.

Realizing this end-to-end is more than a single backend change: it also requires client-side policy decisions and validation (how the originating IP is reliably determined behind reverse proxies / load balancers, what the client is expected to send, and privacy/retention considerations) before it can be applied in production.

## Goal

Provide consistent end-to-end client IP tracking for authentication: record the IP on the audit history and on active sessions, expose it through the GraphQL/REST surface for inspection and filtering, and resolve the client-side policy questions needed to apply it reliably.

## Sub-tasks

- BA-5733 — Include client IP in login_history (audit log)
- BA-6152 — Track originating client IP on active login_sessions

## Open questions / additional work

- Client-side policy: how the originating IP is determined and trusted (e.g. X-Forwarded-For / proxy trust chain).
- Validation across deployment topologies (reverse proxies, load balancers, direct access).
- Privacy and retention considerations for storing client IPs.

JIRA Issue: BA-6168