feat(session): handle sessions for admin

src/interfaces/api/handlers/opaque_auth_handler.rs

@@ -682,6 +682,8 @@ pub async fn login_ke1(
 )]
 pub async fn login_ke3(
     State(state): State<Arc<AppState>>,
+    axum::extract::ConnectInfo(peer): axum::extract::ConnectInfo<std::net::SocketAddr>,
+    headers: axum::http::HeaderMap,
     Json(dto): Json<OpaqueLoginKe3Dto>,
 ) -> Result<impl IntoResponse, AppError> {
     let _svc = require_opaque_service(&state)?;
@@ -764,12 +766,23 @@ pub async fn login_ke3(
         invalid_credentials()
     })?;
 
+    // Capture client IP + User-Agent so `sessions.ip_address` /
+    // `user_agent` land populated instead of NULL (admin panel would
+    // otherwise render "—"). Both are per-session and only refresh
+    // on rotation, matching the login pattern.
+    let client_ip =
+        crate::interfaces::middleware::trusted_proxy::client_ip_from_parts(&headers, Some(peer), false);
+    let user_agent = headers
+        .get(axum::http::header::USER_AGENT)
+        .and_then(|v| v.to_str().ok())
+        .map(str::to_owned);
+
     // Mint the session BEFORE stamping opaque_migrated_at — if the
     // session mint fails (rare, but not impossible under DB failure),
     // we don't want to have flipped the migration flag for a user
     // whose login didn't actually complete.
     let session = auth
-        .mint_session_for_authenticated_user(user, dto.dpop_jkt)
+        .mint_session_for_authenticated_user(user, dto.dpop_jkt, Some(client_ip), user_agent)
         .await
         .map_err(AppError::from)?;