Add the HTTP hardening the policy requires before 1.0 (closes #108)

Every answer carries the six security headers REPO_POLICIES.md lists.
The Content-Security-Policy allows inline content only with a nonce made
for that answer; the pages put it on their style and script blocks and
drop their four style attributes.

The request log and /ip/ take a forwarded address only from a proxy
listed in TRUSTED_PROXIES, which stops the start when set but invalid:
the last X-Forwarded-For entry that is not a trusted proxy. X-Real-IP
and True-Client-IP are no longer read.

The JSON routes and the health check send fixed messages in place of
database, parser and resolver errors, and log the detail.

Model: opus-5-5

internal/server/server.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"net"
 	"net/http"
+	"net/netip"
 	"strconv"
 	"time"
 
@@ -40,6 +41,10 @@ type Server struct {
 	port       int
 	srv        *http.Server
 	asnFetcher ASNFetcher
+
+	// trustedProxies are the reverse proxies whose X-Forwarded-For header
+	// RealIPMiddleware believes
+	trustedProxies []netip.Prefix
 }
 
 // New creates a new HTTP server
@@ -50,10 +55,11 @@ func New(
 	cfg *config.Config,
 ) *Server {
 	s := &Server{
-		db:       db,
-		streamer: streamer,
-		logger:   logger,
-		port:     cfg.Port,
+		db:             db,
+		streamer:       streamer,
+		logger:         logger,
+		port:           cfg.Port,
+		trustedProxies: cfg.TrustedProxies,
 	}
 
 	s.setupRoutes()