WAF helper functions
Extract client IP from request headers Priority: X-Forwarded-For (first IP) > X-Real-IP > "unknown"
Extract domain from Host header Removes port if present (e.g., "example.com:8080" -> "example.com")