Function enrich_context_from_headers 

pub fn enrich_context_from_headers(
    ctx: CratestackContext,
    headers: &HeaderMap,
    trusted_proxy: Option<&TrustedProxyConfig>,
    peer: Option<SocketAddr>,
) -> CratestackContext

Enrich a CratestackContext with the request id (from traceparent) and the client IP recorded on audit events. Malformed traceparent headers are silently ignored here — the auth/header-validation layer is the right place to reject them, not the enrichment seam.

client_ip resolution (#415 — see docs/design/trusted-proxy-client-ip.md for the decided design):

• trusted_proxy is Some and the request’s socket peer is in its allowlist: honor whichever single header TrustedProxyConfig::forwarded_header selects, walking max_hops entries in from the right end of the chain (right-to-left — see TrustedProxyConfig::max_hops). The selected hop is then parsed as an std::net::IpAddr (Finding 2 remediation) — a value that isn’t a real IP address (a spoofed string, a placeholder like unknown, a malformed entry) is never recorded; if the header is absent, doesn’t parse at that hop depth, or doesn’t parse as an IP, this falls back to the socket peer address rather than recording nothing.
• Otherwise (no trusted_proxy configured, or the peer isn’t in its allowlist): headers are never consulted. client_ip is the socket peer address if one is available, or omitted entirely if it isn’t.

The unconfigured default — no Extension<TrustedProxyConfig> applied and/or no ConnectInfo<SocketAddr> available — is the safe one: headers are never trusted, and nothing is guessed. client_ip is simply absent from the audit record.