fix(canary-phase4): address audit nits before rollup

Phase 4 audit (2 agents) returned PASS with three NITs. N1 + N2 cleared
in-phase per the standing fix-in-phase rule. N3 was stylistic-consistency
positive and not actionable.

N1 — generator_test.go IP-precedence subtests: added two missing cases
present in webbug's identical suite (the realIP helper triplet is byte-
identical to webbug, so this is symmetry rather than coverage):
- "RemoteAddr loopback IPv6 strips brackets and port" → "[::1]:9999"
- "XFF IPv6 rightmost" → "198.51.100.1, 2001:db8::dead"

N2 — generator.go patchTemplate loop: the second `cErr := ...` shadowed
nothing but reused the name from the close-error block earlier in the
same iteration. Renamed the header-create variant to `hErr` for clarity.

Audit verdicts:
- superpowers:code-reviewer: PASS (0 B / 0 S / 3 N)
- general-purpose spec-adherence vs §9.3 / §8.5: PASS (0 violations,
  6/6 invariants MATCH, BACKLOG.md still empty)

PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/docx/generator.go

@@ -140,9 +140,9 @@ func patchTemplate(template []byte, triggerURL string) ([]byte, error) {
 		}
 
 		hdr := &zip.FileHeader{Name: f.Name, Method: f.Method}
-		fw, cErr := w.CreateHeader(hdr)
+		fw, hErr := w.CreateHeader(hdr)
-		if cErr != nil {
+		if hErr != nil {
-			return nil, fmt.Errorf("docx: create %s: %w", f.Name, cErr)
+			return nil, fmt.Errorf("docx: create %s: %w", f.Name, hErr)
 		}
 		if _, wErr := fw.Write(body); wErr != nil {
 			return nil, fmt.Errorf("docx: write %s: %w", f.Name, wErr)

PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/docx/generator_test.go

@@ -478,12 +478,26 @@ func TestTrigger_RecordsEventWithRequestMetadata(t *testing.T) {
 				remote:  "[2001:db8::1]:54321",
 				wantIP:  "2001:db8::1",
 			},
+			{
+				name:    "RemoteAddr loopback IPv6 strips brackets and port",
+				headers: nil,
+				remote:  "[::1]:9999",
+				wantIP:  "::1",
+			},
 			{
 				name:    "RemoteAddr without port falls back to raw value",
 				headers: nil,
 				remote:  "127.0.0.1",
 				wantIP:  "127.0.0.1",
 			},
+			{
+				name: "XFF IPv6 rightmost",
+				headers: map[string]string{
+					"X-Forwarded-For": "198.51.100.1, 2001:db8::dead",
+				},
+				remote: "127.0.0.1:9999",
+				wantIP: "2001:db8::dead",
+			},
 			{
 				name: "CF value is trimmed of whitespace",
 				headers: map[string]string{