feat(network): add ProxyCheck IP intelligence

docs/security-review.md

@@ -27,12 +27,14 @@ Next.js portal and APIs, Discord bot, PostgreSQL persistence, Keycloak admin aut
 - ORM-parameterized queries are used throughout.
 - CSP, clickjacking, MIME-sniffing, referrer, and browser-permission headers are configured.
 - Forwarded IP headers are ignored unless `TRUST_PROXY=true` is explicitly configured.
+- Private and reserved addresses are not sent to ProxyCheck.io; lookup results are cached to reduce disclosure and API usage.
+- Portal and game login events include approximate network location and VPN/proxy classification when available.
 - Secrets are excluded from logs and repository configuration.
 
 ## Outstanding production requirements
 
-- Select and implement a VPN/proxy intelligence provider before enabling VPN-based account-addition blocking. The current classification is explicitly `unknown`.
-- Define and automate retention for exact IP addresses and audit events.
+- Monitor ProxyCheck.io usage, detection quality, and false positives. User account additions fail closed when classification is unavailable; hosting-provider blocking remains optional.
+- Define and automate retention for exact IP addresses, cached provider responses, approximate location, and audit events.
 - Add monitoring and alerts for repeated login denials, plugin authentication failures, and Discord API failures.
 - Use HTTPS for the public application and Velocity API URL. Protect the Velocity configuration file because it contains the one-time-displayed API token.
 - Restrict database credentials so normal application roles cannot update or delete historical event rows outside approved application paths.