Read a trusted_proxies entry in the IPv4-mapped form as its IPv4 range (closes #303)

The client address is matched against trusted_proxies as the IPv4 address
an IPv4-mapped address holds, so an entry such as ::ffff:10.0.0.0/104
trusted nothing. parseCIDRList, which reads both trusted_proxies and
blocked_networks, now keeps such an entry as the IPv4 range it covers and
refuses one shorter than /96 naming the setting it reads.
parseBlockedNetworks, which did this for blocked_networks alone, is gone.

Model: opus-5-5

TODO.md

@@ -30,6 +30,10 @@ P2: security: per-origin rate limiting
 
 # Completed Steps
 
+- 2026-10-19 a `trusted_proxies` entry in the IPv4-mapped form trusted nothing;
+  it is now read as the IPv4 range it covers by the same code that reads
+  `blocked_networks`, and such an entry shorter than `/96` aborts startup
+  (closes #303).
 - 2026-10-18 a `blocked_networks` entry in the IPv4-mapped form refused nothing;
   `::ffff:10.0.0.0/104` is now read as `10.0.0.0/8`, and such an entry shorter
   than `/96` aborts startup (closes #301).