The ctx.state key under which http-security-plugin's ipSecurityMiddleware publishes the resolved client IP, and from which auth-plugin's rateLimitMiddleware reads it back.

Exported from common so the two packages agree on the value byte-for-byte instead of each hardcoding the literal — the validatedStateKey precedent. Before this constant existed both sides spelled 'clientIp' inline, where a typo on one side is a silent miss rather than a compile error.