README.md: rework against the review findings

The check sentence names HEAD for the S3 regions up front. The rate-limit
sentence states the safe rate plainly: an address that sends at most half
the limit in any 60 seconds is never refused. The upaas `TRUSTED_PROXIES`
entry again warns that a client connecting from a trusted address can
write its own `X-Forwarded-For`, that a connection through a published
Docker port can arrive from the Docker network's gateway, which the
default includes, and that set and empty, every client behind the proxy
shares one allowance. `TODO.md` gets the Completed Steps entry for
#189, now that
#196 has merged. For
#195.

Model: fable-5-1

TODO.md

@@ -23,6 +23,10 @@ Run `make frontend-viewport-test` in CI as its own step; it is not part of
 
 # Completed Steps
 
+- 2026-10-26: `README.md`, `TODO.md` and `test/viewport/README.md` are rewritten
+  sentence by sentence ([#189](https://git.eeqj.de/sneak/netwatch/issues/189)).
+  Each sentence reads on the first pass: one idea, under about 30 words, the
+  verb early. Every statement matches the code on `next`.
 - 2026-10-26: a target whose home page answers with a redirect is checked at
   `/robots.txt` on the same host, which answers without one
   ([#194](https://git.eeqj.de/sneak/netwatch/issues/194)). These are the AWS