feat: structured body-parse error log (#288) and client-IP extraction helper (#289)

[ijeoma270]

Closes #288
Closes #289

What changed

#288 — Structured log for request body parse failure (src/middlewares/body-parse-error.middleware.ts)

Added a dedicated Express error-handler middleware that intercepts body-parsing failures on mutation endpoints and emits a structured error-level log before returning the client response.

What is logged:

• type: "body_parse_failure"
• method and path (endpoint path)
• requestId (for correlation with other log entries)
• clientIp (extracted via the trusted-proxy-aware helper from Add helper for extracting client IP from forwarded headers in request context #289)
• errorType: "invalid_json" or "entity.too.large"

What is NOT logged:

• Raw request body (never read or forwarded)
• Request headers beyond standard Express fields

Behaviour:

• Fires only on POST, PUT, PATCH, DELETE (mutation methods)
• GET, HEAD, and all non-parse errors pass through to next() unchanged
• Client response is unchanged: 400 for malformed JSON, 413 for oversized payloads
• Mounted in app.ts immediately after express.json() — before routes and the global error handler

Tests (14): all mutation verbs, GET passthrough, generic error passthrough, entity.too.large handling, assertion that body is absent from log, client response shape

---

#289 — Client IP extraction helper (src/utils/client-ip.utils.ts)

Added getClientIp(req, trusted?) — a small, reusable helper that reads the real client IP from X-Forwarded-For when the socket comes from a trusted proxy, falling back to the direct socket address otherwise.

Resolution order:

1. If req.socket.remoteAddress is a trusted proxy (loopback, RFC-1918, IPv6 ULA), read the first (leftmost) IP from X-Forwarded-For
2. Fall back to the direct socket address

Trust model:

• Defaults to matching private/loopback CIDR ranges only — untrusted public IPs cannot spoof forwarded headers
• Accepts an optional trusted predicate override for tests or custom deployments

Integration points:

• request-logger.middleware.ts — clientIp field added to every request log entry
• body-parse-error.middleware.ts — clientIp included in parse-failure error logs

Tests (11): trusted loopback/private ranges, multi-hop X-Forwarded-For, array-valued header, custom predicate, untrusted socket passthrough, missing socket edge cases

How to test

# Run the new test suites
pnpm exec jest --testPathPatterns="client-ip.utils|body-parse-error" --no-coverage

# Verify end-to-end: send malformed JSON to a mutation endpoint
curl -X POST http://localhost:3000/api/v1/creators \
  -H "Content-Type: application/json" \
  -d '{bad json}'
# → server logs should contain type:"body_parse_failure" with path + requestId
# → client receives 400 {"success":false,"message":"Invalid JSON in request body"}

[drips-wave]

@ijeoma270 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[ijeoma270]

Closing in favour of separate PRs per issue.