[QuentinFuxa]

Rejected requests were logged without the peer address, and capacity rejections and REST token failures were not logged at all. An operator could not trace repeated attempts or feed them to fail2ban or a proxy rule. This follows the remarks in discussion #463.

Changes:

• Token rejections on /asr, /v1/listen and /v1/audio/transcriptions log a warning ending with (client=ADDRESS). The REST route did not log before.
• The session limit middleware logs a warning with the same suffix when it refuses an upgrade.
• The token is never logged.
• docs/deployment.md describes the log lines. The Nginx example now sets X-Forwarded-For to $remote_addr, so a client cannot choose the logged address, and shows a per-address limit_conn, since the session cap is shared by all clients of a worker.

The address is the direct peer. Behind a proxy it is the forwarded address only when --forwarded-allow-ips trusts that proxy, which is Uvicorn's existing behaviour.

Validation:

• The existing rejection scenarios in tests/test_session_limits.py and tests/test_server.py now assert the logged address and that a wrong token does not appear in the log. They fail without the change (6 failures) and pass with it.
• Against a real Uvicorn server with 127.0.0.1 as trusted proxy, a request carrying X-Forwarded-For: 203.0.113.7 logs client=203.0.113.7. With proxy headers off it logs client=127.0.0.1.
• Ruff passes.

Not validated: the Nginx directives were not run against an Nginx instance.

This does not add a per-client session cap inside WLK. Behind a shared proxy address that would need its own design.