feat(admission): add group VPN exceptions

design/us-007-ip-intelligence.md

@@ -3,7 +3,7 @@ type: User Story
 title: Enrich portal and game login IPs
 description: Login audit events include cached approximate location and network intelligence from ProxyCheck.io.
 tags: [security, network, audit, proxycheck]
-timestamp: 2026-08-01T22:04:17Z
+timestamp: 2026-08-02T14:12:43Z
 story_id: US-007
 status: verified
 ---
@@ -19,7 +19,7 @@ As an operator, I want portal and registered game logins enriched with network c
 - [x] Provider failures are cached briefly and do not deny portal or registered game login.
 - [x] Private, loopback, reserved, documentation, and mapped-private addresses are never sent to ProxyCheck.
 - [x] Forwarded web IP headers are ignored unless trusted-proxy handling is explicitly enabled.
-- [x] Unknown game accounts do not trigger paid ProxyCheck lookups.
+- [x] Every authenticated Velocity login request uses the cached ProxyCheck path before identity resolution, preventing account-creation races from bypassing network policy.
 - [x] Login events and IP observations retain the available classification and approximate location.
 - [x] Users and administrators can see available location and classification in audit views.
 - [x] Repeated access observations are summarized by IPv4 /24 or IPv6 /64 network with counts, sources, and latest activity.