1.7.1: security fixes for the checkout and the client IP

- The discount follows the billing email, the address the order is
  placed under. The tracked session email used to win, so a guest could
  post a discounted address to the tracking endpoint and check out under
  their own, keeping the discount.
- Shipping packages carry the matched assignment, so WooCommerce's
  per-package rate cache no longer reuses rates filtered for a matched
  address (free shipping, reserved methods) after the email changes.
- The anonymous tracking endpoint no longer answers matched: true|false,
  which let anyone enumerate discounted addresses and domains.
- CF-Connecting-IP is believed only from a Cloudflare edge range or a
  private/loopback proxy. From anyone else it let a direct client pick a
  new address per request: no REST rate limit, forged audit-log IPs.

Smoke tests: 89 assertions (was 73), each fix with its own.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/CONTRACT.md

@@ -1,6 +1,6 @@
 # Contract
 
-Every hook this plugin offers, and every family hook it answers. Version 1.7.0.
+Every hook this plugin offers, and every family hook it answers. Version 1.7.1.
 
 A contract is a name somebody else has to know. Core hooks this plugin merely
 listens to — `init`, `admin_menu`, `wp_enqueue_scripts` — are not here;

docs/README.md

@@ -1,6 +1,6 @@
 # Nolimit Discounts
 
-Version 1.7.0 · a WooCommerce plugin · slug `woocommerce-email-discount-manager`
+Version 1.7.1 · a WooCommerce plugin · slug `woocommerce-email-discount-manager`
 
 Gives a customer a discount, and decides which shipping methods they may
 choose, based on the email address they check out with.

docs/RELEASE.md

@@ -1,6 +1,6 @@
 # Releasing
 
-One release a day at most, cut by hand. Version 1.7.0 is current.
+One release a day at most, cut by hand. Version 1.7.1 is current.
 
 ## The sequence
 
@@ -45,7 +45,7 @@ is loud, an id that belongs to something else is not.
 | --- | --- | --- |
 | `ci/static.sh` | syntax, guards, text domain, no secrets, every loaded file ships, one version everywhere, the two compat files agree, no tracked file writes a git identity, the docs still describe this tree | a count on every passing line |
 | `ci/selftest.sh` | **the checkers themselves** — see below | `all N assertions passed` |
-| `ci/site-test.sh` | a real WordPress + WooCommerce + MySQL install, this plugin activated, `tests/smoke.php` run through `wp eval-file` | `All 73 assertions passed`, floored at 60 by the caller |
+| `ci/site-test.sh` | a real WordPress + WooCommerce + MySQL install, this plugin activated, `tests/smoke.php` run through `wp eval-file` | `All 89 assertions passed`, floored at 60 by the caller |
 | `.github/workflows/compat.yml` | the matrix: PHP 7.4 / 8.3 / 8.4, WP latest and nightly, WC latest and beta | one job per cell |
 
 ## The checkers are themselves tested, and that is unusual