docs: document trusted_proxies and record in TODO.md

Describe the trusted_proxies key in README.md and config.example.yml,
including the rightmost-non-proxy selection rule and the safe default of
trusting no one. Record the unit in TODO.md.

Model: opus-4-8

TODO.md

@@ -30,6 +30,17 @@ exhaustion
 
 # Completed Steps
 
+- 2026-09-21 trusted-proxy client IP resolution (closes #94): a
+  `trusted_proxies` config key taking a list of CIDRs, parsed by the same
+  `net/netip` list parser as `blocked_networks` (an invalid entry aborts
+  startup naming the key and value; omitted or empty trusts no one); a new
+  `internal/clientip` package resolves the client address by honoring
+  `X-Forwarded-For` only when the direct peer is a trusted proxy, walking
+  the chain right-to-left to the rightmost non-proxy entry, so a client
+  connecting directly cannot spoof its address; the resolved address is
+  stored in the request context by a new middleware and used by the
+  request-logging middleware and the login-attempt logs in place of the
+  raw peer address; documented in `README.md` and `config.example.yml`.
 - 2026-09-21 blocked networks configuration extending SSRF protection: a
   `blocked_networks` config key taking a list of CIDRs (parsed with
   `net/netip`, an invalid entry aborts startup naming the key and value),