Correct release-blocking README and startup-warning inaccuracies (closes #151)

The empty-TRUSTED_PROXIES warning was gated on IsProd(), but
WEBHOOKER_ENVIRONMENT defaults to dev, so an internet-exposed
deployment whose operator never set it got no warning at all — the
exact operator error the warning exists to catch. It now fires whenever
the list is empty, in any environment, and its text is accurate both
behind a reverse proxy (shared buckets, remotely deniable admin login)
and with nothing in front of the process (harmless). The startup
configuration summary also now logs sessionIdleTimeout, the one value
where a valid setting silently disables a security control.

The README documented a two-stage Docker build on golang:1.24 running
"make check" (the tree has three stages: a golangci-lint lint stage
running fmt-check and lint, a golang:1.26.1-bookworm builder running
test and build, then the Alpine runtime), advertised the public
receiver as accepting all methods (it answers 405 to everything but
POST), claimed unqualified per-IP login rate limiting, and left the
session-expiry prose orphaned inside the trusted-proxy subsection.

The rest of the README was swept against the code rather than only the
reported lines: every documented route checked method-by-method against
internal/server/routes.go (adding the password-change, entrypoint and
target routes that were missing), every environment variable checked
against internal/config/config.go (MAINTENANCE_MODE serves no
maintenance page — it only sets a healthcheck field), the fx wiring,
package tree, prerequisites and dev commands brought back in line with
the tree, and two statements known false from other reviews corrected:
the body-size limit does not reject before "any other middleware" (the
eight global ones run first), and a retention value at or above the
retain-forever sentinel is accepted rather than 400ed.

TODO.md drops the unsupported half of its CI claim, keeping the
cache-defeated container runs, and splits the landed password change
away from the unimplemented reset flow.

TODO.md

@@ -25,13 +25,17 @@ password change flow (#65), policy compliance (#6), pinned lint tooling
 (#55), and fail-loud configuration parsing (#80).
 
 `next` holds the completed 1.0.0 milestone: every issue in it is closed,
-and it is verified green both by CI and by cache-defeated container
-runs. The two were only made to mean the same thing this cycle — before
-#119, a warm layer cache let the gate report success without executing
-anything, and replayed the previous build's console log so the lie
-looked like a real run. Note: TODO.md was deliberately deleted from this
-repo in f9a9569 (2026-03-01, #6); its content was folded into the README
-TODO section, which this draft reconstructs as of 2026-07-06.
+and it is verified green by cache-defeated container runs
+(`docker build --no-cache-filter=lint --no-cache-filter=builder`). The
+CI status is not independently claimed here: a superseded run is
+recorded as `skipped` and still rolls up green, so a commit status on
+`next` does not by itself evidence an executed check (#152). Before
+#119, a warm layer cache also let the gate report success without
+executing anything, and replayed the previous build's console log so
+the lie looked like a real run. Note: `TODO.md` was deliberately
+deleted from this repo in f9a9569 (2026-03-01, #6); its content was
+folded into the README TODO section, which this draft reconstructs as
+of 2026-07-06.
 
 # Next Step
 
@@ -190,7 +194,9 @@ rate-limit keys should bucket by `/64`).
     - OpenAPI specification
 - Analytics dashboard: success rates, response times, volume
 - A remember-me option at login
-- Password change and reset flow
+- Password reset flow for a forgotten password. The authenticated
+  password *change* flow already landed on `main` (#65); reset does not
+  exist
 - Later, nice to have
     - email delivery target type
     - SNS and S3 delivery targets