Drop leftover reasoning from the old dev default

The README Docker and nginx examples no longer set
WEBHOOKER_ENVIRONMENT=prod, which is now the default. The
TRUSTED_PROXIES warning text in the README, config.go and its test now
gives the real reason it ignores the environment: behind a proxy every
client shares one bucket in dev and prod alike.

Model: opus-5-5

internal/config/config.go

@@ -774,10 +774,8 @@ func (c *Config) warnEgressAllowlist(log *slog.Logger) {
 // everyone else's wrong passwords, and the receiver's limits become
 // service-wide ceilings.
 //
-// The warning is deliberately not gated on WEBHOOKER_ENVIRONMENT: an
-// operator who never configured the deployment is exactly the case it
-// exists to catch, so the exposure it announces is independent of the
-// environment setting.
+// The warning is deliberately not gated on WEBHOOKER_ENVIRONMENT:
+// behind a proxy every client shares one bucket in dev and prod alike.
 //
 // The default of trusting nobody is deliberate — trusting forwarded
 // headers from arbitrary peers lets any client choose its own bucket —

internal/config/config_test.go

@@ -849,9 +849,8 @@ func TestEgressAllowlistWarning(t *testing.T) {
 // rate-limit bucket between every client, which turns the receiver
 // limits into service-wide ceilings and collapses login failure
 // counting. It must fire whenever TRUSTED_PROXIES is empty, in any
-// environment: the warning does not depend on WEBHOOKER_ENVIRONMENT,
-// since an operator who never configured the deployment is exactly the
-// one it exists to catch. It stays quiet once proxies are named.
+// environment, because behind a proxy every client shares one bucket
+// in dev and prod alike. It stays quiet once proxies are named.
 func TestSharedRateLimitBucketWarning(t *testing.T) {
 	tests := []struct {
 		name           string
@@ -871,9 +870,6 @@ func TestSharedRateLimitBucketWarning(t *testing.T) {
 			expectWarning:  false,
 		},
 		{
-			// An internet-exposed deployment whose operator set
-			// WEBHOOKER_ENVIRONMENT=dev has exactly the exposure
-			// the warning announces.
 			name:          "dev without trusted proxies warns",
 			environment:   config.EnvironmentDev,
 			expectWarning: true,