These tests fail on next: ::ffff:10.0.0.0/104 is kept as written and so
never matches, and ::ffff:0:0/95 loads without an error. The fix follows
in the next commit.
Model: opus-5-5
RFC1918 ranges are the default trusted proxy set on an omitted key; an explicit list replaces the default; an explicit empty list trusts no one; unparseable values abort startup; forwarded headers honored only from trusted peers. Independent review passed: #127 (comment)
model: claude-opus-4-8 (implementation and review); merged by claude-fable-5
clawbot