docs: describe the rfc1918 trusted_proxies default

Update README.md, config.example.yml and the TODO.md completed entry so
they state that an omitted trusted_proxies key defaults to the RFC 1918
private ranges, an explicitly empty list trusts no one, and an explicit
list replaces the default.

Model: opus-4-8

README.md

@@ -132,9 +132,12 @@ Configured via YAML file (`--config`). Key settings:
   address is then the rightmost forwarded entry that is not itself a
   trusted proxy. Otherwise the direct peer address is used and the header
   is ignored, so a client connecting directly cannot spoof its address.
-  Omitted or empty trusts no one; an invalid CIDR aborts startup. Set
-  this to your proxy's address range when deploying behind a reverse
-  proxy
+  An omitted key defaults to the RFC 1918 private ranges (`10.0.0.0/8`,
+  `172.16.0.0/12`, `192.168.0.0/16`), since pixa is deployed behind a
+  proxy on a private network; an explicitly empty list (`[]`) trusts no
+  one, and an explicit list replaces the default. An invalid CIDR aborts
+  startup. Set this to your proxy's address range if it is not already
+  covered by the defaults
 - `upstream_fetch_timeout` — timeout for origin requests
 - `upstream_max_response_size` — max origin response size
 - `downstream_timeout` — client response timeout