Cap SSE subscribers per client IP instead of only globally (B-38)

GET /rounds/stream capped concurrent subscribers with one global
counter (MAX_SUBSCRIBERS=500): anyone opening 500 connections degraded
every other user to polling. The comment called it a defensive cap;
it was actually the vector, since nothing stopped a single source from
exhausting it alone.

RoundEventBroadcaster now also tracks subscribers per client IP,
capped much lower (MAX_SUBSCRIBERS_PER_IP=5). Past that cap, opening
one more stream evicts that same IP's own oldest connection (woken via
a new EVICTED sentinel so the SSE generator closes it promptly) rather
than refusing the new one or letting one abusive IP crowd out unrelated
clients under the old global-only cap. The global cap stays as a
backstop against overall resource exhaustion regardless of source.

Extracted client_ip() (X-Forwarded-For, since Caddy reverse-proxies
every request) out of auth/routes.py into app/api/client_ip.py so the
login/registration throttles (B-33) and this new per-IP cap share one
definition instead of two that could drift apart.

Not implemented: enforcing the connection cap at the Caddy layer
itself, which the proposed fix also suggested - the standard Caddy
image this project uses has no such directive without a third-party
module, and building a custom image felt like a bigger, separate change
than this fix warranted.

Suite grows from 201 to 211 tests. BUGS.md moves B-38 to Previously
fixed.

app/api/routes/rounds.py

@@ -8,12 +8,13 @@ from pydantic import BaseModel
 from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.api.client_ip import client_ip
 from app.api.timeutil import isoformat_utc
 from app.auth.dependencies import get_optional_user
 from app.db.models import RoundParticipant, User
 from app.db.session import get_session
 from app.rounds.config import get_round_config
-from app.rounds.events import RoundEventCapacityError, broadcaster
+from app.rounds.events import EVICTED, RoundEventCapacityError, broadcaster
 from app.rounds.service import get_active_round
 
 router = APIRouter(prefix="/rounds", tags=["rounds"])
@@ -46,9 +47,14 @@ async def round_stream(request: Request) -> Response:
     That's also what happens past MAX_SUBSCRIBERS (app/rounds/events.py): this
     returns 503 rather than opening a stream, and the browser's EventSource
     just retries later while the frontend keeps working off polling meanwhile.
+
+    Concurrent streams are additionally capped per client IP (B-38): past
+    MAX_SUBSCRIBERS_PER_IP, opening one more evicts that IP's own oldest
+    connection rather than refusing the new one or letting a single source
+    exhaust the global cap and degrade every other user.
     """
     try:
-        queue = broadcaster.subscribe()
+        queue = broadcaster.subscribe(client_ip(request))
     except RoundEventCapacityError:
         return JSONResponse(status_code=503, content={"detail": "too many concurrent update streams"})
 
@@ -59,7 +65,9 @@ async def round_stream(request: Request) -> Response:
                 if await request.is_disconnected():
                     break
                 try:
-                    await asyncio.wait_for(queue.get(), timeout=_SSE_DISCONNECT_CHECK_SECONDS)
+                    item = await asyncio.wait_for(queue.get(), timeout=_SSE_DISCONNECT_CHECK_SECONDS)
+                    if item is EVICTED:
+                        break  # this IP opened another stream past its per-IP cap
                     yield "event: update\ndata: {}\n\n".format(json.dumps({}))
                     ticks_since_keepalive = 0
                 except asyncio.TimeoutError: