docs(auth): correct stale SESSION_IP_BINDING comments

The 'wired but not yet consulted' struct comments became false when
validation started honoring the mode; document the fail-closed default
for managers built without config.Load, and note in .env.example that
log mode persists the (parse-validated) new IP as the session binding.

Author: fmaass

deploy/.env.example

@@ -18,7 +18,9 @@ SSO_SECRET=
 
 # How a session presented from a different client IP than it was created from
 # is handled (default: log). One of: log, strict, off.
-#   log    - record the mismatch and serve the request anyway
+#   log    - record the mismatch, serve the request, and remember the new IP
+#            as the session's binding (a parseable IP only; garbage is never
+#            persisted)
 #   strict - reject the session, forcing re-authentication
 #   off    - do not compare client IPs at all
 # SESSION_IP_BINDING=log

internal/auth/portal_session.go

@@ -58,8 +58,9 @@ type PortalSessionManager struct {
 	cookieManager
 	db database.Database
 	// ipBinding is the resolved SESSION_IP_BINDING mode (config.SessionIPBinding*)
-	// that portal session validation applies to a client-IP change. Wired but
-	// not yet consulted; ValidatePortalSession still behaves as before.
+	// that portal session validation applies to a client-IP change. An unknown
+	// or zero value is treated as strict so managers built without config.Load
+	// fail closed.
 	ipBinding string
 }
 

internal/auth/session.go

@@ -55,8 +55,9 @@ type SessionManager struct {
 	opaqueKey         []byte
 	sessionValidation *sessionValidator
 	// ipBinding is the resolved SESSION_IP_BINDING mode (config.SessionIPBinding*)
-	// that session validation applies to a client-IP change. Wired but not yet
-	// consulted; validation still behaves as before.
+	// that session validation applies to a client-IP change. An unknown or
+	// zero value is treated as strict so managers built without config.Load
+	// fail closed.
 	ipBinding string
 }