Improve IP address tracking: add fallback and logging

Enhancements:
- Updated extractIpAddress() to accept directIp parameter with fallback to req.ip
- Added IP address to system event logging (initialize, session_delete)
- Added unique IP count to stateless transport metrics UI
- Removed package-lock.json as requested

The IP extraction now prioritizes:
1. x-forwarded-for header (for proxied traffic)
2. x-real-ip header (nginx)
3. req.ip (direct connection)

Author: claude