test(plugin-auth): the account-event audit fixture hands the client as the transport peer

The fixture supplied its client through a forwarded header on a
deployment that declares no trusted proxy. The library's reader now
follows the client-address trust rule, which does not believe that
header, so the fixture hands the address the rule does believe: the
transport's peer address.

Claude-Session: https://claude.ai/code/session_01UmqzD97e14iws6hmVhgZ5y
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/plugins/plugin-auth/src/auth-account-event-audit.test.ts

@@ -56,17 +56,20 @@ function deployment(config: Record<string, unknown> = {}) {
   return { engine, manager, events };
 }
 
+// The client is the connection's peer address, handed over the way the auth
+// route hands the transport's peer: the address the client-address trust rule
+// (`client-address.ts`) establishes when no proxy is declared trusted.
 const post = (manager: AuthManager, path: string, body: unknown) =>
   manager.handleRequest(
     new Request(`${BASE}${path}`, {
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
-        'x-forwarded-for': CLIENT_IP,
         'user-agent': CLIENT_UA,
       },
       body: JSON.stringify(body),
     }),
+    { remoteAddress: CLIENT_IP },
   );
 
 async function signUp(manager: AuthManager): Promise<void> {