Unset TRUSTED_PROXIES trusts the RFC 1918 ranges (closes #119)

With TRUSTED_PROXIES unset, bin/entrypoint.sh gives nginx one
set_real_ip_from line for each of 10.0.0.0/8, 172.16.0.0/12 and
192.168.0.0/16, as sneak ruled on 2026-09-22 for every app. A list
replaces them, and set and empty trusts no proxy; each entry is checked
as before. The backend inside the container still trusts only
127.0.0.1/32. Both READMEs, nginx.conf and the comment in
script/frontend-viewport-test say the new default.

Model: opus-5-5

backend/README.md

@@ -121,12 +121,14 @@ replaces the security headers this server sets with those in the root
 The container's own `TRUSTED_PROXIES` goes to nginx instead: IP addresses or
 CIDRs, separated by commas, of the reverse proxies in front of the container.
 nginx takes the client address from `X-Forwarded-For` only on a request from one
-of them. Unset or empty, nginx trusts no proxy, and the client address is the
-one each request comes from, so every client behind a proxy shares one rate
-limit. An entry that is not an IP address or CIDR, such as a hostname or
-`1.2.3`, stops the container at start with an error naming `TRUSTED_PROXIES`:
-the entrypoint checks each entry with `netwatch-server check-cidr`, which parses
-it as this server parses its own `TRUSTED_PROXIES`.
+of them. Unset, nginx trusts `10.0.0.0/8`, `172.16.0.0/12` and `192.168.0.0/16`,
+and a list replaces them. Set and empty, nginx trusts no proxy, and the client
+address is the one each request comes from, so every client behind a proxy
+shares one rate limit. An entry that is not an IP address or CIDR, such as a
+hostname or `1.2.3`, stops the container at start with an error naming
+`TRUSTED_PROXIES`: the entrypoint checks each entry with
+`netwatch-server check-cidr`, which parses it as this server parses its own
+`TRUSTED_PROXIES`.
 
 ### Report storage