Trust reverse proxies at private addresses by default (closes #198)

With TRUSTED_PROXIES unset, the server now trusts reverse proxies in the
private ranges of RFC 1918. A proxy such as traefik on a Docker network is
then believed, so /ip/, the home page's curl card and the request log give
the client its X-Forwarded-For names instead of the proxy's address.

A list in TRUSTED_PROXIES replaces the default. TRUSTED_PROXIES set but
empty trusts no proxy, so the config package reads it with os.LookupEnv.
A direct client at a public address still cannot choose its address with
a forged header.

Model: opus-5-5

TODO.md

@@ -35,6 +35,11 @@ tested.
 
 # Completed Steps
 
+- 2026-10-27: with `TRUSTED_PROXIES` unset, the server trusts reverse proxies at
+  the private addresses of RFC 1918, so `/ip/`, the home page's `curl` card and
+  the request log give the client a proxy names in `X-Forwarded-For`. They used
+  to give the proxy's address. A list in `TRUSTED_PROXIES` replaces the default,
+  and `TRUSTED_PROXIES` set but empty trusts no proxy (closes #198)
 - 2026-10-27: the home page has cards with figures of the routing table: the
   newest and oldest kept route, the newest and oldest updated AS, the AS with
   the most prefixes, the ASes with a single prefix, and fifteen well-known