Log failed logins and refused tokens, address first

For Guard's jarl preset and fail2ban: msg="login failed" ip=... user=...
and msg="token refused" ip=..., beside the audit records.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/h_acme.go

@@ -198,6 +198,8 @@ func (s *Server) httpreqPrincipal(w http.ResponseWriter, r *http.Request) (*auth
 	}
 	fail := func(reason string) error {
 		s.limiter.fail("ip:" + ip)
+		// For Guard and fail2ban: the address first, so a name can't fake it.
+		s.log.Warn("token refused", "ip", ip, "reason", "httpreq: "+reason)
 		s.eng.Audit(r.Context(), &auth.Principal{User: &model.User{Username: user}, IP: ip, Agent: r.UserAgent(), Method: "token"}, "auth.token_failed", "", 0, "", "failure", "httpreq: "+reason)
 		w.Header().Set("WWW-Authenticate", httpreqRealm)
 		return &httpError{http.StatusUnauthorized, "unauthenticated", "invalid credentials: " + reason}