Unset TRUSTED_PROXIES trusts RFC 1918, empty trusts none (closes #129)

The backend's own TRUSTED_PROXIES now follows the ruling for every app:
unset, it trusts 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16, no longer
loopback; a list replaces that; set and empty, it trusts no proxy.

viper reads an empty environment variable as unset, so an empty value
got the default. config.New now checks os.LookupEnv for this one
setting. viper's AllowEmptyEnv would do it too, but for every setting,
so an empty PORT or DEBUG would stop the start instead of counting as
unset.

bin/entrypoint.sh still starts the backend with
TRUSTED_PROXIES=127.0.0.1/32.

Model: opus-5-5

TODO.md

@@ -21,6 +21,12 @@ Run `make frontend-viewport-test` in CI as its own step; it is not part of
 
 # Completed Steps
 
+- 2026-10-14: the backend's own `TRUSTED_PROXIES`
+  ([#129](https://git.eeqj.de/sneak/netwatch/issues/129)), unset, trusts
+  `10.0.0.0/8`, `172.16.0.0/12` and `192.168.0.0/16`, no longer loopback; set
+  and empty, it trusts no proxy, where it got the default because viper reads an
+  empty environment variable as unset; a list replaces the default. The image
+  still starts the backend with `TRUSTED_PROXIES=127.0.0.1/32`
 - 2026-10-14: the repo has the layout `REPO_POLICIES.md` gives
   ([#30](https://git.eeqj.de/sneak/netwatch/issues/30)). The Go module is at the
   root (`go.mod`, `go.sum`, `.golangci.yml`, `cmd/netwatch-server/`,