Trust the RFC 1918 ranges as proxies when TRUSTED_PROXIES is unset (closes #333)

Unset or empty, TRUSTED_PROXIES now defaults to 10.0.0.0/8,
172.16.0.0/12 and 192.168.0.0/16, so a reverse proxy reaching the app
over a Docker network or a private LAN gets per-client rate-limit
buckets without configuration. A set value replaces the default; an
unparseable one still fails startup.

The startup warning for an empty list goes, with its test hook and
test, since the default is no longer empty. The README's
configuration table, Trusted proxies, upaas and reverse-proxy sections
describe the new default and when to narrow it to the proxy alone.

Model: opus-5-5

internal/handlers/auth.go

@@ -103,9 +103,10 @@ func (h *Handlers) renderLoginError(
 // The credential check runs BEFORE any rate-limit budget is
 // consulted, and only a failed check spends budget. That is what
 // keeps the single administrative path reachable: behind the reverse
-// proxy this deployment requires, with TRUSTED_PROXIES unset, every
-// client shares one bucket, so a limiter spent on arrival lets any
-// stranger deny the operator's own correct password indefinitely.
+// proxy this deployment requires, when TRUSTED_PROXIES does not cover
+// it, every client shares one bucket, so a limiter spent on arrival
+// lets any stranger deny the operator's own correct password
+// indefinitely.
 //
 // Verifying first means every login POST costs an Argon2id hash, so
 // the work is taken under a bounded number of verification slots.