Add the HTTP hardening the policy requires before 1.0 (closes #108)

Every answer carries the six security headers REPO_POLICIES.md lists.
The Content-Security-Policy allows inline content only with a nonce made
for that answer; the pages put it on their style and script blocks and
drop their four style attributes.

The request log and /ip/ take a forwarded address only from a proxy
listed in TRUSTED_PROXIES, which stops the start when set but invalid:
the last X-Forwarded-For entry that is not a trusted proxy. X-Real-IP
and True-Client-IP are no longer read.

The JSON routes and the health check send fixed messages in place of
database, parser and resolver errors, and log the detail.

Model: opus-5-5

internal/config/config_internal_test.go

@@ -1,7 +1,9 @@
 package config
 
 import (
+	"net/netip"
 	"runtime"
+	"slices"
 	"testing"
 )
 
@@ -44,6 +46,55 @@ func TestNewRefusesInvalidPort(t *testing.T) {
 	}
 }
 
+func TestNewReadsTrustedProxies(t *testing.T) {
+	t.Setenv("PORT", "")
+	t.Setenv("XDG_DATA_HOME", "")
+
+	t.Setenv("TRUSTED_PROXIES", "")
+
+	cfg, err := New()
+	if err != nil {
+		t.Fatalf("New() without TRUSTED_PROXIES: %v", err)
+	}
+
+	if len(cfg.TrustedProxies) != 0 {
+		t.Errorf("New() without TRUSTED_PROXIES: TrustedProxies = %v, want none",
+			cfg.TrustedProxies)
+	}
+
+	t.Setenv("TRUSTED_PROXIES", "10.0.0.0/8, 192.0.2.1,2001:db8::/32")
+
+	cfg, err = New()
+	if err != nil {
+		t.Fatalf("New() with TRUSTED_PROXIES: %v", err)
+	}
+
+	want := []netip.Prefix{
+		netip.MustParsePrefix("10.0.0.0/8"),
+		netip.MustParsePrefix("192.0.2.1/32"),
+		netip.MustParsePrefix("2001:db8::/32"),
+	}
+	if !slices.Equal(cfg.TrustedProxies, want) {
+		t.Errorf("TrustedProxies = %v, want %v", cfg.TrustedProxies, want)
+	}
+}
+
+func TestNewRefusesInvalidTrustedProxies(t *testing.T) {
+	invalid := []string{"proxy.example", "10.0.0.0/33", "192.0.2.1:80", "192.0.2.1,"}
+	for _, value := range invalid {
+		t.Run(value, func(t *testing.T) {
+			t.Setenv("PORT", "")
+			t.Setenv("XDG_DATA_HOME", "")
+			t.Setenv("TRUSTED_PROXIES", value)
+
+			_, err := New()
+			if err == nil {
+				t.Errorf("New() with TRUSTED_PROXIES=%q returned no error", value)
+			}
+		})
+	}
+}
+
 func TestNewRefusesRelativeXDGDataHome(t *testing.T) {
 	if runtime.GOOS == "darwin" {
 		t.Skip("macOS does not read XDG_DATA_HOME")