feat(api, webapp): add IP/UA logging, direct viewer audit trail, and endpoint hardening

See merge request isard/isardvdi!4182