chore: harden external traffic attribution and clean external monitor output

apps/web/src/app/api/traffic/route.ts

@@ -82,11 +82,42 @@ export async function GET(request: NextRequest) {
     actorSummaryRows.map((row) => [row.actorType, row._count._all])
   );
 
+  const isInternalActorId = (actorId: string | null | undefined) => {
+    if (!actorId) return true;
+    const normalized = actorId.toLowerCase();
+
+    if (normalized === "unknown" || normalized === "mcp-anonymous") {
+      return true;
+    }
+
+    const ipMatch = normalized.match(/^open-tasks:([a-z0-9.:_-]+)$/);
+    if (!ipMatch?.[1]) {
+      return false;
+    }
+
+    const actorIp = ipMatch[1];
+    if (actorIp.startsWith("127.") || actorIp.startsWith("10.") || actorIp.startsWith("192.168.")) {
+      return true;
+    }
+
+    if (actorIp.startsWith("172.")) {
+      const secondOctet = Number(actorIp.split(".")[1]);
+      return secondOctet >= 16 && secondOctet <= 31;
+    }
+
+    if (actorIp === "localhost" || actorIp === "unknown" || actorIp.startsWith("fc") || actorIp.startsWith("fd")) {
+      return true;
+    }
+
+    return false;
+  };
+
   const externalActorSummary = externalActorRows
     .map((row) => ({
       actorId: row.actorId || "unknown",
       events: row._count._all,
     }))
+    .filter((row) => !isInternalActorId(row.actorId))
     .sort((a, b) => b.events - a.events)
     .slice(0, 20);
 
@@ -127,7 +158,7 @@ export async function GET(request: NextRequest) {
   });
 
   const recentExternalEvents = recentEvents.filter((event) =>
-    event.action.startsWith("EXTERNAL_")
+    event.action.startsWith("EXTERNAL_") && !isInternalActorId(event.actorId)
   );
 
   const recentInternalEvents = recentEvents.filter(