Drop leftover reasoning from the old dev default

The README Docker and nginx examples no longer set
WEBHOOKER_ENVIRONMENT=prod, which is now the default. The
TRUSTED_PROXIES warning text in the README, config.go and its test now
gives the real reason it ignores the environment: behind a proxy every
client shares one bucket in dev and prod alike.

Model: opus-5-5

internal/config/config.go

@@ -774,10 +774,8 @@ func (c *Config) warnEgressAllowlist(log *slog.Logger) {
 // everyone else's wrong passwords, and the receiver's limits become
 // service-wide ceilings.
 //
-// The warning is deliberately not gated on WEBHOOKER_ENVIRONMENT: an
-// operator who never configured the deployment is exactly the case it
-// exists to catch, so the exposure it announces is independent of the
-// environment setting.
+// The warning is deliberately not gated on WEBHOOKER_ENVIRONMENT:
+// behind a proxy every client shares one bucket in dev and prod alike.
 //
 // The default of trusting nobody is deliberate — trusting forwarded
 // headers from arbitrary peers lets any client choose its own bucket —