Add a trusted_proxies CIDR-list config key alongside blocked_networks. Generalize the blocked_networks parser into parseCIDRList and cidrListEntries, which take the key name as a parameter, so both keys share one parser rather than a second copy. An invalid entry aborts startup naming the key and value; an omitted or empty key leaves the list empty. Model: opus-4-8