docs: document trusted_proxies and record in TODO.md

Describe the trusted_proxies key in README.md and config.example.yml,
including the rightmost-non-proxy selection rule and the safe default of
trusting no one. Record the unit in TODO.md.

Model: opus-4-8

config.example.yml

@@ -31,6 +31,18 @@ allowlist_hosts:
 #   - 100.64.0.0/10
 #   - 2001:db8::/32
 
+# CIDR ranges of the reverse proxies in front of pixa. X-Forwarded-For
+# is believed only when the direct peer is inside one of these ranges;
+# the client address in the access log and login records is then the
+# rightmost forwarded entry that is not itself a trusted proxy. A client
+# connecting directly (peer outside these ranges) cannot spoof its
+# address: the header is ignored and the peer address is used. Omitted or
+# empty trusts no one; an invalid CIDR aborts startup. Set this when
+# deploying behind a proxy.
+# trusted_proxies:
+#   - 10.0.0.0/8
+#   - 2001:db8::/32
+
 # Allow HTTP upstream (only for testing, always use HTTPS in production)
 allow_http: false