Keep board IDs out of server logs, show real client IPs, no traceback for early disconnects

[k3mpaxl]

Why

The Azure App Service log of v0.5.3 showed:

1. Board IDs in the log: INFO: 169.254.129.1:43805 - "WebSocket /ws/boards/<board UUID>" [accepted] for every connection. The board ID is the board's access key. --no-access-log does not stop these lines; Uvicorn logs WebSocket connections through uvicorn.error. App Service keeps container logs (log stream, storage, Log Analytics).
2. A traceback after a restart: a browser closed its connection before sending hello (code 1005), the handler closed the dead connection again, Uvicorn raised ClientDisconnected → "Exception in ASGI application".
3. The proxy's IP instead of the client's (169.254.129.1).

What changed

• HideBoardIds logging filter on uvicorn.error and uvicorn.access: /boards/<uuid> becomes /boards/<board> in message and arguments.
• refuse() closes refused connections and ignores a connection that is already gone (RuntimeError, OSError = uvicorn's ClientDisconnected, WebSocketDisconnect). A browser that leaves before hello ends the handler without closing again. Replacing a duplicated tab's old connection (4001) ignores a gone connection the same way.
• Real client IPs: the Docker image sets FORWARDED_ALLOW_IPS=127.0.0.1,::1,169.254.0.0/16.
  • Uvicorn reads X-Forwarded-For only from those addresses; App Service front ends use the link-local range, which no client can have from outside, so nobody can fake an IP in the log.
  • Uvicorn 0.54 parses App Service's IP:port format.
  • Behind another reverse proxy, set FORWARDED_ALLOW_IPS to its address (README).
• README security notes updated.

For reviewers

• tests/test_logs.py starts Uvicorn with INFO logs and the image's proxy setting, connects with X-Forwarded-For: 203.0.113.9:51515, lets one browser close cleanly, one drop the TCP connection and one say hello. It asserts: no board ID in the log, "WebSocket /ws/boards/<board>" [accepted], the real IP, no traceback.
• Against the old code it fails with the board ID and with exactly the traceback from App Service (WebSocketDisconnect: (1005, None) → ClientDisconnected, line 837).
• All backend tests pass.
• Logs written before this change still contain board IDs: restrict who can read them or delete them, and move sensitive boards to a new ID (JSON export, import into a new board).

🤖 Generated with Claude Code