Trust reverse proxies at private addresses by default (closes #198)

With TRUSTED_PROXIES unset, the server now trusts reverse proxies in the
private ranges of RFC 1918. A proxy such as traefik on a Docker network is
then believed. /ip/, the home page's curl card and the request log give the
client's address from X-Forwarded-For instead of the proxy's address.

A list in TRUSTED_PROXIES replaces the default. TRUSTED_PROXIES set but
empty trusts no proxy, so the config package reads it with os.LookupEnv.
A direct client at a public address still cannot choose its address with
a forged header.

Model: opus-5-5

README.md

@@ -585,11 +585,11 @@ What the [upaas](https://git.eeqj.de/sneak/upaas) app needs:
 
 - Container port: `8080`.
 - Volume: one, at container path `/var/lib/berlin.sneak.app.routewatch`.
-- Environment: nothing. The server trusts a reverse proxy at a private address
-  without `TRUSTED_PROXIES` (see Configuration). Set it only when the proxy in
-  front of the app connects from a public address. Leave `XDG_DATA_HOME`,
-  `GOMEMLIMIT` and `MALLOC_ARENA_MAX` at the image's values. `DEBUG=routewatch`
-  is optional and adds the `System stats` memory line to the log.
+- Environment: nothing. The server trusts a reverse proxy at an RFC 1918 address
+  without `TRUSTED_PROXIES` (see Configuration). Set it only when the proxy
+  connects from any other address. Leave `XDG_DATA_HOME`, `GOMEMLIMIT` and
+  `MALLOC_ARENA_MAX` at the image's values. `DEBUG=routewatch` is optional and
+  adds the `System stats` memory line to the log.
 - Memory Limit: `5g`, the 5 GiB limit from Memory above. upaas sets no swap
   limit, so on a host with swap Docker allows the same amount of swap again.
 - Health check: the image's `HEALTHCHECK` requests

TODO.md

@@ -36,8 +36,8 @@ tested.
 # Completed Steps
 
 - 2026-10-27: with `TRUSTED_PROXIES` unset, the server trusts reverse proxies at
-  the private addresses of RFC 1918, so `/ip/`, the home page's `curl` card and
-  the request log give the client a proxy names in `X-Forwarded-For`. They used
+  the private addresses of RFC 1918. `/ip/`, the home page's `curl` card and the
+  request log then give the client's address from `X-Forwarded-For`. They used
   to give the proxy's address. A list in `TRUSTED_PROXIES` replaces the default,
   and `TRUSTED_PROXIES` set but empty trusts no proxy (closes #198)
 - 2026-10-27: the home page has cards with figures of the routing table: the