fix(auth): an IPv6 visitor counts by their /64

One household's line or one server gets a whole /64 of IPv6 addresses,
and could turn through them past every per-network limit (the second
reading's M5). networkOf now counts an IPv6 visitor by their /64
(networkKeyOf), an IPv4 visitor by their address as before.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/lib/src/common/network.dart

@@ -1,4 +1,5 @@
 import 'dart:io';
+import 'dart:typed_data';
 
 import 'package:serverpod/serverpod.dart';
 
@@ -13,16 +14,35 @@ import 'package:serverpod/serverpod.dart';
 // Never the `Forwarded` header, which Caddy passes on as the visitor wrote
 // it, and so never Serverpod's `remoteInfo`, which prefers that header.
 
-/// The network [session]'s request came from (see above): its visitor's
-/// address, or `null` for a session without a request (tests, future
-/// calls), as the limits have always taken it.
+/// The network [session]'s request came from (see above), as the limits
+/// count it ([networkKeyOf]): its visitor's address, an IPv6 visitor's /64,
+/// or `null` for a session without a request (tests, future calls), as the
+/// limits have always taken it.
 String networkOf(Session session) {
   final request = session.request;
-  return '${visitorAddress(
-    socket: request == null ? null : '${request.connectionInfo.remote.address}',
-    forwardedFor: request?.headers['x-forwarded-for'],
-    trustedProxies: trustedProxies(),
-  )}';
+  return networkKeyOf(
+    visitorAddress(
+      socket: request == null
+          ? null
+          : '${request.connectionInfo.remote.address}',
+      forwardedFor: request?.headers['x-forwarded-for'],
+      trustedProxies: trustedProxies(),
+    ),
+  );
+}
+
+/// The network the limits count [address] in: an IPv4 address itself, an
+/// IPv6 address's /64 (`2001:db8:1:2::/64`; the second reading's M5), since
+/// one household's line or one server gets a whole /64 and could turn
+/// through its addresses past every limit; `null` for none.
+String networkKeyOf(String? address) {
+  final parsed = address == null ? null : InternetAddress.tryParse(address);
+  if (parsed == null || parsed.type != InternetAddressType.IPv6) {
+    return '$address';
+  }
+  final prefix = [...parsed.rawAddress.take(8), ...List.filled(8, 0)];
+  return '${InternetAddress.fromRawAddress(Uint8List.fromList(prefix)).address}'
+      '/64';
 }
 
 /// The address of the visitor whose connection came from [socket] (none