Track sessions via X-Session-ID header for accurate admin dashboard

Claude Code --session-id <uuid> sends X-Session-ID on every request.
Use this header as the session identifier instead of inferring from
client IP (gateway_<ip>), which is unreliable when multiple sessions
share an IP. Fall back to gateway IP for non-session-ID requests.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

api/services.py

@@ -106,6 +106,18 @@ def _get_client_ip(request: Request) -> str | None:
     return None  # Direct connection
 
 
+def _get_session_id(request: Request) -> str:
+    """Get session ID from X-Session-ID header or fall back to gateway IP.
+
+    Claude Code sends X-Session-ID when started with --session-id <uuid>.
+    """
+    session = request.headers.get("X-Session-ID")
+    if session:
+        return session
+    ip = _get_client_ip(request)
+    return f"gateway_{ip}" if ip else "direct"
+
+
 class ClaudeProxyService:
     """Coordinate request optimization, model routing, and providers."""
 
@@ -122,16 +134,6 @@ class ClaudeProxyService:
         self._token_counter = token_counter
         self._session_tracker = SessionTracker.get_instance()
 
-    def _get_session_id(self, request: Request, request_data: MessagesRequest) -> str:
-        """Extract or generate a session ID for gateway clients only."""
-        # Check if request came through a gateway/proxy
-        ip = _get_client_ip(request)
-        if ip is None:
-            return "direct"  # Don't track direct connections
-
-        # Use gateway client IP as session identifier
-        return f"gateway_{ip}"
-
     def create_message(self, request: Request, request_data: MessagesRequest) -> object:
         """Create a message response or streaming response with optional failover."""
         try:
@@ -210,7 +212,7 @@ class ClaudeProxyService:
             thinking_enabled=resolved.thinking_enabled,
         )
 
-        session_id = self._get_session_id(request, request_data)
+        session_id = _get_session_id(request)
         self._session_tracker.track_request_sync(session_id, resolved.provider_id)
 
         request_id = f"req_{uuid.uuid4().hex[:12]}"
@@ -274,7 +276,7 @@ class ClaudeProxyService:
                     thinking_enabled=resolved.thinking_enabled,
                 )
 
-                session_id = self._get_session_id(request, request_data)
+                session_id = _get_session_id(request)
                 self._session_tracker.track_request_sync(
                     session_id, resolved.provider_id
                 )