docs(authentication): say Setup shows the address the server judges before an allowed IP ranges save (#30582)

<!-- claude-projects-attribution: {"github_login":"os-bill"} -->
_Requested by **Bill** · [project
thread](https://claude.ai/code/project/chan_016iMXWSZDzqWRWvWzdNo8wg?thread=cmsg_016iMXWSZDzqWRWvWzdNo8wgAN5RsxTefC5pvUfxZKt8ai)_

domain:server#2 · os-bill · session_01Utp6CZhiLoN3MZGp7ZnqCg

Fixes #30570

Clause-②: no — docs only
Metadata-protocol: none

## 维护者速读

- 改了什么：`authentication.mdx` 的「Saving, clearing and lockout
recovery」加一条，写明 Setup → Authentication 在「允许的 IP 段」字段下显示服务器判定的本次请求地址，数据来自
`GET /api/v1/auth/admin/client-address`（仅平台管理员），并说明三种提示各指什么。
- 为什么改：#30398（接口）和 #30313（控制台提示，PR
#30540）都已落地，文档却只讲了保存被拒时才告诉你地址，没说保存前在哪能看到。
- 风险与回滚：纯文档，一个文件加 8 行，不动任何代码或发布面；措辞逐句对过 `main` 上控制台的英文文案。回滚即撤本 PR。
- 先看：`content/docs/permissions/authentication.mdx` 新增的「Setup shows your
address before you save.」一条。
- 两分钟验证：打开 PR 的 Files changed，对照 `ui/packages/i18n/src/locales/en.ts` 的
`clientAddressDirect` / `clientAddressViaProxy` / `clientAddressUnknown`
三句，预期文档描述与三句一一对应、无多说。
- 需要你做的：无，席位落地。

## What changes

One new bullet in **Saving, clearing and lockout recovery** (chosen over
the `allowed_ip_ranges` table row: the row already defers the save
behaviour to that section, and the note is about what you see before a
save, so it sits next to the save rule it previews):

> **Setup shows your address before you save.** Under the field, **Setup
→ Authentication** shows the address the server judges for your request,
read from `GET /api/v1/auth/admin/client-address` (platform
administrators only), which answers `{ clientAddress, trustProxy }`: the
note says whether that address came from the forwarded headers of a
proxy the server trusts (`server.trustProxy`) or from the connection
itself, which behind a proxy it does not trust is the proxy's own
address, and when `clientAddress` is `null` it says instead that no
non-empty list can be saved.

Checked against `main` at `db04e5ce`, which carries PR #30540
(`b6f4c0e8b7`):

- `ui/apps/console/src/pages/settings/SettingsView.tsx`
`clientAddressNote`: three states, `clientAddress === null` →
`clientAddressUnknown`, `trustProxy` → `clientAddressViaProxy`, else
`clientAddressDirect`; drawn only on the `auth` namespace under
`allowed_ip_ranges`.
- `ui/packages/i18n/src/locales/en.ts`: `clientAddressDirect` ("…This
server does not trust proxy headers, so behind a proxy this is the
proxy's address."), `clientAddressViaProxy` ("…read from the forwarded
headers of the proxy this server trusts…"), `clientAddressUnknown` ("The
server cannot establish your address, so a non-empty list cannot be
saved from here.").
- `packages/plugins/plugin-auth/src/client-address-read.ts`: `200 {
success: true, data: { clientAddress, trustProxy } }`, `clientAddress`
`null` when no address can be established, `gateAdmin` (platform admin),
`Cache-Control: no-store`.

Not said, because the console does not do it: no note is drawn when the
read fails (non-admin, older server); the page does not claim one. No
other sentence on the page is made false by the read: the
`allowed_ip_ranges` row and the refusal bullet stay true as written.

Changeset: none. Followed AGENTS.md Post-Task Checklist step 3 and
os-dev's rule: `skip-changeset` is for a diff that publishes nothing
from any released package; `content/docs/**` is in no package's
`files[]` (the repo's own negative control in
`scripts/check-changeset-no-major.mjs` names `content/docs/**` as
publishing nothing). Label `skip-changeset` rides this create.

## Verification

- `node scripts/pm/dispatch-gates.mjs --commands --repo
objectstack-ai/objectstack content/docs/permissions/authentication.mdx`:
45 commands. All 45 exit 0 at head `115efa0e`; five first exited 3
(prerequisite: `@objectstack/spec`, `@objectstack/lint`,
`@objectstack/formula`, `@objectstack/client-react` not built) and were
re-run green after `turbo run build` of those closures. `--ran`
reconciliation: 45 derived, 45 run, 0 NOT-MEASURED, 0 UNRUN.
- Not run locally, left to CI: the `Build Docs` job and the type-check
lanes `dispatch-gates` lists as CI-only.
- Dogfood: not run (docs only, no `!`, no narrowing arm).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01Utp6CZhiLoN3MZGp7ZnqCg

---
_Generated by [Claude
Code](https://claude.ai/code/session_01Utp6CZhiLoN3MZGp7ZnqCg)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

content/docs/permissions/authentication.mdx

@@ -669,6 +669,14 @@ These rules apply to `allowed_ip_ranges`.
   because the gate would refuse you too. Only a change is checked: saving the list
   already in force again is not refused. Writes made inside the server (boot, seed,
   migrations) carry no request and are not checked.
+- **Setup shows your address before you save.** Under the field, **Setup →
+  Authentication** shows the address the server judges for your request, read from
+  `GET /api/v1/auth/admin/client-address` (platform administrators only), which
+  answers `{ clientAddress, trustProxy }`: the note says whether that address came
+  from the forwarded headers of a proxy the server trusts (`server.trustProxy`) or
+  from the connection itself, which behind a proxy it does not trust is the proxy's
+  own address, and when `clientAddress` is `null` it says instead that no non-empty
+  list can be saved.
 - **Clearing takes effect at once.** Empty the field and save. No restart is needed:
   the gate goes back to the list the deployment itself declares (`allowedIpRanges` in
   its auth configuration, for example set by an `auth:configure` handler), or to no