Docs: rproxy runs behind any TLS-terminating reverse proxy (closes #388)

README, SPEC and docs no longer present traefik as the required front
proxy. The README gains "The reverse proxy in front", listing what that
proxy must do: forward plain HTTP to port 8080, keep Host, set
X-Forwarded-For and X-Forwarded-Proto, and connect from an address in
SWW_RPROXY_TRUSTED_PROXIES. traefik, Caddy and nginx appear as examples,
with the nginx headers spelled out since it sets none by default.

Model: opus-5-5

docs/request-log.md

@@ -68,7 +68,8 @@ Every one of these lines has:
 ### Request detail
 
 - `request_id`: the id `rproxy` made for the request when it arrived.
-- `peer_ip`: the address of `rproxy`'s TCP peer, normally traefik.
+- `peer_ip`: the address of `rproxy`'s TCP peer, normally the reverse proxy in
+  front of it.
 - `forwarded_for`: the `X-Forwarded-For` header the visitor's request came with.
 - `client_group`: the client as rate limiting counts it, an IPv4 address as a
   /32 or an IPv6 group.

docs/settings.md

@@ -478,9 +478,9 @@ start, and an invalid value stops the start. Any can be given as a file, as a
   `10.0.0.0/8,172.16.0.0/12,192.168.0.0/16`): the netblocks whose
   `X-Forwarded-For` is believed. Set but empty, it trusts nothing. A client
   outside these netblocks cannot claim another address. Where other containers
-  reach `rproxy` directly, or visitors on a private network reach traefik, they
-  can name another address in the header. Narrowing the setting to traefik's own
-  network closes that gap.
+  reach `rproxy` directly, or visitors on a private network reach the reverse
+  proxy in front, they can name another address in the header. Narrowing the
+  setting to that proxy's own network closes that gap.
 
 ## The image's command