feat(agent): 配对尝试记录来源 IP

"十次失败"说明窗口关了，"十次来自 10.0.0.7 的失败"说明有人在试——后者才是可行动
的那句话，而它是尝试次数上限无法提供的信息。每次尝试与每次成功现在都带 peer。

只记 IP 不记端口：端口每次都是新的临时号，带上会让同一台机器的两次尝试看起来像
两台，而"有几台机器在试"正是要回答的问题。

测试断言失败尝试带上了 peer，且是去掉端口后的主机。变异验证：去掉 peer，测试失败。

Go 全包、Node 120 项、Swift 107 项通过。

internal/pair/pair.go

@@ -19,6 +19,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"net"
 	"net/http"
 	"sync"
 	"time"
@@ -179,7 +180,7 @@ func (h *Handler) provision(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	if !h.authorize(body.Password) {
-		h.log("pair_attempt", map[string]any{"outcome": "bad_secret"})
+		h.log("pair_attempt", map[string]any{"outcome": "bad_secret", "peer": peerOf(r)})
 		writeError(w, http.StatusUnauthorized, "the shared secret did not match")
 		return
 	}
@@ -195,7 +196,7 @@ func (h *Handler) provision(w http.ResponseWriter, r *http.Request) {
 	if err := config.Save(h.cfgPath, h.cfg); err != nil {
 		// The device was not added if the save failed, so a retry is safe and the phone must not
 		// be handed a keypair the agent will not honour.
-		h.log("pair_attempt", map[string]any{"outcome": "save_failed", "error": err.Error()})
+		h.log("pair_attempt", map[string]any{"outcome": "save_failed", "error": err.Error(), "peer": peerOf(r)})
 		writeError(w, http.StatusInternalServerError, "the agent could not persist the pairing")
 		return
 	}
@@ -203,7 +204,7 @@ func (h *Handler) provision(w http.ResponseWriter, r *http.Request) {
 	// second phone means re-running --pair, which is the right amount of friction for a socket
 	// that grants device trust.
 	h.closeLocked()
-	h.log("pair_provision", map[string]any{"outcome": "ok", "app": deviceID})
+	h.log("pair_provision", map[string]any{"outcome": "ok", "app": deviceID, "peer": peerOf(r)})
 	writeJSON(w, provisionResponse{
 		NodeID:       h.nodeID,
 		AppID:        deviceID,
@@ -230,7 +231,7 @@ func (h *Handler) destroy(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	if !h.authorize(body.Password) {
-		h.log("pair_attempt", map[string]any{"outcome": "bad_secret_destroy"})
+		h.log("pair_attempt", map[string]any{"outcome": "bad_secret_destroy", "peer": peerOf(r)})
 		writeError(w, http.StatusUnauthorized, "the shared secret did not match")
 		return
 	}
@@ -240,7 +241,7 @@ func (h *Handler) destroy(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	h.closeLocked()
-	h.log("pair_destroy", map[string]any{"outcome": "ok"})
+	h.log("pair_destroy", map[string]any{"outcome": "ok", "peer": peerOf(r)})
 	writeJSON(w, map[string]any{"destroyed": true})
 }
 
@@ -279,6 +280,20 @@ func mustPublic(private []byte) []byte {
 	return key
 }
 
+// peerOf reports the caller's address, for the log only.
+//
+// It is the one piece of context the attempt ceiling cannot supply: "ten failed pairings" says the
+// window closed, and "ten failed pairings from 10.0.0.7" says someone is trying. Only the IP is kept,
+// never the port, because the port is a fresh ephemeral number on every attempt and would make two
+// attempts from one host look like two hosts.
+func peerOf(r *http.Request) string {
+	host, _, err := net.SplitHostPort(r.RemoteAddr)
+	if err != nil {
+		return r.RemoteAddr
+	}
+	return host
+}
+
 func writeJSON(w http.ResponseWriter, body any) {
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(http.StatusOK)