- ServeRPC now applies real-IP + WAF interceptors to streaming RPCs
(RequestTask, IOStream), not just unary calls; without them
authHandler.check saw an empty real IP so brute-force BlockIP counters
never keyed on a source and the WAF block table was bypassed at the
stream entrypoint. Factored real-IP resolution into ctxWithRealIP shared
by unary and stream paths.
- handleFsRead rejects negative offset/length; handleFsWrite validates
if_match_sha256 is 64 hex chars before dispatch.
- createAPIToken always verifies each server_id exists (even for admins),
so an admin cannot bind a PAT to a not-yet-created server id that a
future server would auto-inherit.
- Add relay zero-length-chunk rejection regression test.
Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>
