Unset TRUSTED_PROXIES trusts the RFC 1918 ranges (closes #119)

With TRUSTED_PROXIES unset, bin/entrypoint.sh gives nginx one
set_real_ip_from line for each of 10.0.0.0/8, 172.16.0.0/12 and
192.168.0.0/16, as sneak ruled on 2026-09-22 for every app. A list
replaces them, and set and empty trusts no proxy; each entry is checked
as before. The backend inside the container still trusts only
127.0.0.1/32. Both READMEs, nginx.conf and the comment in
script/frontend-viewport-test say the new default.

Model: opus-5-5

TODO.md

@@ -22,6 +22,12 @@ Decide whether the repo moves to the layout `REPO_POLICIES.md` gives, with
 
 # Completed Steps
 
+- 2026-10-14: with `TRUSTED_PROXIES` unset, the container's nginx trusts the
+  three private ranges of RFC 1918, `10.0.0.0/8`, `172.16.0.0/12` and
+  `192.168.0.0/16` ([#119](https://git.eeqj.de/sneak/netwatch/issues/119)), as
+  sneak ruled on 2026-09-22 for every app; it trusted no proxy before. A list
+  replaces them, and set and empty it trusts none. The backend inside the
+  container still trusts only `127.0.0.1/32`
 - 2026-10-07: the files shared from `sneak/prompts` are its copies at commit
   `dd4027b` ([#113](https://git.eeqj.de/sneak/netwatch/issues/113)), with this
   repository's own entries after the shared content in `.gitignore`,