Client address is the right-most untrusted X-Forwarded-For entry (closes #144)

From a peer in TRUSTED_PROXIES, clientIP took the left-most
X-Forwarded-For entry, which the client writes itself behind a proxy
that appends to the header, so a client could choose the address the
rate limit counts and the request log records. It now walks the entries
from the right past trusted proxies and takes the first that is not
one. An entry written as an address with a port is read as that
address; with only trusted entries, or one that is not an address at
all, it uses the peer. Every X-Forwarded-For header line is read.
X-Real-IP is read only when there is no X-Forwarded-For entry.
README.md Settings says which entry is taken.

Model: opus-5-5

TODO.md

@@ -32,11 +32,9 @@ Run `make frontend-viewport-test` in CI as its own step; it is not part of
   used. `X-Real-IP` is read only without `X-Forwarded-For`, and every
   `X-Forwarded-For` header line is read, not only the first. The image's nginx,
   and the `TRUSTED_PROXIES=127.0.0.1/32` it starts the backend with, are
-  unchanged; the comment in `configs/nginx.conf` that said the backend takes the
-  first entry now says it takes the one address nginx passes on. Unit tests
-  resolve the address from chains ending in an untrusted address, in trusted
-  ones, of only trusted ones, with ports, with an entry that is not an address,
-  and split over two header lines
+  unchanged. Unit tests resolve the address from chains ending in an untrusted
+  address, in trusted ones, of only trusted ones, with ports, with an entry that
+  is not an address, and split over two header lines
 - 2026-10-18: after an interval change, the summary's Reachable slot reads
   `--/--` in white, as at page load, until the second round since the change
   ends ([#140](https://git.eeqj.de/sneak/netwatch/issues/140)). It used to read

configs/nginx.conf

@@ -46,9 +46,7 @@ server {
     # 127.0.0.1:8081. These headers go with every request passed to it.
     # X-Forwarded-For carries only the client address, as resolved by
     # the real IP settings above, and not the chain the request came
-    # with. bin/entrypoint.sh starts the backend with
-    # TRUSTED_PROXIES=127.0.0.1/32, the address nginx connects from, so
-    # the backend takes that one entry as the client address.
+    # with: the backend takes the first entry, which a client can write.
     proxy_set_header Host $host;
     proxy_set_header X-Real-IP $remote_addr;
     proxy_set_header X-Forwarded-For $remote_addr;