fix: correct add_subscriber upstream_addr usage per Claude review

- Line 748 (SeekNode): Pass None instead of self.upstream_addr because
  subscriber address was already corrected by Gateway. Using upstream_addr
  would overwrite with the forwarder's address.

- Line 932 (ReturnSub): Pass None instead of self.upstream_addr because
  sender was looked up from source_addr and already has correct address.
  Using upstream_addr would use the original requester's address instead
  of the provider's.

Addresses Claude code review feedback.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

Author: sanity

crates/core/src/operations/subscribe.rs

@@ -742,10 +742,13 @@ impl Operation for SubscribeOp {
                         subscribers_before = ?before_direct,
                         "subscribe: attempting to register direct subscriber"
                     );
-                    // Use upstream_addr for NAT routing - subscriber may embed wrong address
+                    // Pass None: subscriber address was already corrected by Gateway at the
+                    // start of the subscribe flow. Using self.upstream_addr here would
+                    // incorrectly overwrite with the forwarder's address instead of the
+                    // original subscriber's Gateway-corrected address.
                     if op_manager
                         .ring
-                        .add_subscriber(key, subscriber.clone(), self.upstream_addr)
+                        .add_subscriber(key, subscriber.clone(), None)
                         .is_err()
                     {
                         tracing::warn!(
@@ -926,10 +929,13 @@ impl Operation for SubscribeOp {
                             subscribers_before = ?before_provider,
                             "subscribe: registering provider/subscription source"
                         );
-                        // Use upstream_addr for NAT routing - sender may embed wrong address
+                        // Pass None: sender was already looked up from source_addr (line ~866),
+                        // so it has the correct transport address. Using self.upstream_addr
+                        // would incorrectly use the original requester's address instead of
+                        // the provider's address.
                         if op_manager
                             .ring
-                            .add_subscriber(key, sender.clone(), self.upstream_addr)
+                            .add_subscriber(key, sender.clone(), None)
                             .is_err()
                         {
                             // concurrently it reached max number of subscribers for this contract