Function: forwardedIpMiddleware()
forwardedIpMiddleware(
options):Middleware
Server-side forwarded-IP middleware. On every request it reads the buyer IP,
shop slug and secret (lazy getters — a rotated secret is picked up without
rebuilding the pipeline), signs ${ip}.${ts}.${shopSlug} with HMAC-SHA256 and
adds the three forwarded-IP headers. When any input is missing it adds nothing
— the backend then keys the connection IP (the server-side default).
The HMAC key is imported once per distinct secret value and reused across requests (re-imported only on rotation).