Function extractPeerContext

Extract a PeerIdentifyContext from an incoming request.

• ip — resolved via resolveIp
• userId — reads the x-user-id header as a convenience; callers should override after authentication if needed
• tlsProfile — defers to req.tlsProfile (set by tls-devicer middleware) then falls back to x-ja4 / x-ja3 proxy headers