test(utils): cover hashIp and getClientIp

[waterlemonnn]

Summary

Adds lib/utils/hash.test.ts, covering the two functions in lib/utils/hash.ts that had no test coverage.

• hashIp() throws when IP_HASH_PEPPER is unset
• hashIp() is deterministic for a given input/pepper pair, and differs across peppers
• hashIp() trims surrounding whitespace before hashing
• getClientIp() takes the first entry of a comma-separated x-forwarded-for
• getClientIp() falls back to x-real-ip, then to "unknown"

Closes #26.

Test plan

• npx vitest run lib/utils/hash.test.ts — 7/7 passing
• npx vitest run — full suite, 94/94 passing
• npm run lint — clean
• npx tsc --noEmit — clean