docs: attach parseCIDRList doc to its own function

The paragraph describing parseCIDRList sat above defaultTrustedProxies
with no separating blank line, so both bound to defaultTrustedProxies as
one doc block and parseCIDRList had none. Move it to immediately precede
func parseCIDRList.

Model: opus-4-8

internal/config/config.go

@@ -844,12 +844,6 @@ func getStringSlice(sc *smartconfig.Config) []string {
 	return nil
 }
 
-// parseCIDRList parses the value of the named config key into CIDR
-// prefixes, or returns nil if the key is omitted. It accepts a YAML list
-// of strings or a comma-separated string. An explicitly null value, a
-// wrong type, an empty entry, a non-string entry, or an unparseable CIDR
-// aborts startup naming the key and the offending value; the default
-// (an empty list) applies only to an omitted key.
 // defaultTrustedProxies returns the trusted_proxies default: the three RFC
 // 1918 private ranges. pixa is always deployed behind a TLS-terminating
 // reverse proxy, which in practice sits on a private network, so its
@@ -865,6 +859,12 @@ func defaultTrustedProxies() []netip.Prefix {
 	}
 }
 
+// parseCIDRList parses the value of the named config key into CIDR
+// prefixes, or returns nil if the key is omitted. It accepts a YAML list
+// of strings or a comma-separated string. An explicitly null value, a
+// wrong type, an empty entry, a non-string entry, or an unparseable CIDR
+// aborts startup naming the key and the offending value; the default
+// (an empty list) applies only to an omitted key.
 func parseCIDRList(sc *smartconfig.Config, key string) ([]netip.Prefix, error) {
 	if sc == nil {
 		return nil, nil