Log real client IPs via Fly-Client-IP header in proxy access logs

The Fly.io edge proxy forwards the original client IP in the
Fly-Client-IP header. Add this as a `client_ip` field in the nginx
JSON log format and extract it in the Alloy pipeline so Loki/Grafana
show real visitor IPs instead of the internal proxy address
(172.16.11.178).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/changelog.d/fix-real-client-ip-logging.bugfix.md

@@ -0,0 +1 @@
+Log real client IPs in Fly.io proxy access logs using Fly-Client-IP header instead of showing the internal proxy address.

fly/alloy.river

@@ -24,6 +24,7 @@ loki.process "nginx" {
   // Parse the JSON log line
   stage.json {
     expressions = {
+      client_ip            = "client_ip",
       status               = "status",
       method               = "request_method",
       host                 = "http_host",

fly/nginx.conf

@@ -13,6 +13,7 @@ http {
         '{'
             '"time":"$time_iso8601",'
             '"remote_addr":"$remote_addr",'
+            '"client_ip":"$http_fly_client_ip",'
             '"request_method":"$request_method",'
             '"request_uri":"$request_uri",'
             '"status":$status,'