add unit tests and run in workflow

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/test_app.py

@@ -0,0 +1,40 @@
+import unittest
+from datetime import datetime, timezone
+
+from app import build_payload
+
+
+class TestBuildPayload(unittest.TestCase):
+    def test_uses_forwarded_ip(self):
+        now = datetime(2026, 2, 6, 0, 0, 0, tzinfo=timezone.utc)
+        payload = build_payload(
+            headers={"X-Forwarded-For": "10.0.0.1, 10.0.0.2", "User-Agent": "ua"},
+            client_ip="192.168.0.10",
+            method="GET",
+            path="/",
+            now=now,
+        )
+        self.assertEqual(payload["ip"], "10.0.0.1")
+        self.assertEqual(payload["user_agent"], "ua")
+        self.assertEqual(payload["method"], "GET")
+        self.assertEqual(payload["path"], "/")
+        self.assertEqual(payload["timestamp"], "2026-02-06T00:00:00+00:00")
+
+    def test_falls_back_to_client_ip(self):
+        now = datetime(2026, 2, 6, 0, 0, 0, tzinfo=timezone.utc)
+        payload = build_payload(
+            headers={"User-Agent": "ua"},
+            client_ip="192.168.0.10",
+            method="POST",
+            path="/submit",
+            now=now,
+        )
+        self.assertEqual(payload["ip"], "192.168.0.10")
+        self.assertEqual(payload["user_agent"], "ua")
+        self.assertEqual(payload["method"], "POST")
+        self.assertEqual(payload["path"], "/submit")
+        self.assertEqual(payload["timestamp"], "2026-02-06T00:00:00+00:00")
+
+
+if __name__ == "__main__":
+    unittest.main()