optionally stamp ip header for downstream use

server/lib/aiGatewayTrust.ts

@@ -12,6 +12,15 @@ export const AI_GATEWAY_RESOURCE_TYPE_HEADER =
 
 export type AiGatewayResourceType = "resource" | "site-resource";
 
+// Opt-in (server.enable_ai_gateway_client_ip_header): carries the client IP
+// that Badger resolved at the Traefik hop, so it survives an intermediary
+// proxy between Traefik and the AI gateway that overwrites
+// X-Forwarded-For/X-Real-Ip instead of appending to them. Set by a
+// disableForwardAuth Badger middleware instance (see getTraefikConfig.ts)
+// on the site-resource inference router only, since that's the sole path
+// that resolves request identity from the client IP.
+export const AI_GATEWAY_CLIENT_IP_HEADER = "X-Pangolin-Client-Ip";
+
 /**
  * Derive a Traefik-injected trust token from the server secret.
  * Traefik overwrites this header on inference routes so the AI gateway can