docs: describe the rfc1918 trusted_proxies default

Update README.md, config.example.yml and the TODO.md completed entry so
they state that an omitted trusted_proxies key defaults to the RFC 1918
private ranges, an explicitly empty list trusts no one, and an explicit
list replaces the default.

Model: opus-4-8

config.example.yml

@@ -36,9 +36,12 @@ allowlist_hosts:
 # the client address in the access log and login records is then the
 # rightmost forwarded entry that is not itself a trusted proxy. A client
 # connecting directly (peer outside these ranges) cannot spoof its
-# address: the header is ignored and the peer address is used. Omitted or
-# empty trusts no one; an invalid CIDR aborts startup. Set this when
-# deploying behind a proxy.
+# address: the header is ignored and the peer address is used. When
+# omitted, this defaults to the RFC 1918 private ranges (10.0.0.0/8,
+# 172.16.0.0/12, 192.168.0.0/16), since pixa is deployed behind a proxy on
+# a private network. An explicitly empty list ([]) trusts no one; an
+# explicit list replaces the default. An invalid CIDR aborts startup.
+# Uncomment to override the defaults with your proxy's address range.
 # trusted_proxies:
 #   - 10.0.0.0/8
 #   - 2001:db8::/32