Trust the RFC 1918 ranges as proxies when TRUSTED_PROXIES is unset (closes #333)

Unset or empty, TRUSTED_PROXIES now defaults to 10.0.0.0/8,
172.16.0.0/12 and 192.168.0.0/16, so a reverse proxy reaching the app
over a Docker network or a private LAN gets per-client rate-limit
buckets without configuration. A set value replaces the default; an
unparseable one still fails startup.

The startup warning for an empty list goes, with its test hook and
test, since the default is no longer empty. The README's
configuration table, Trusted proxies, upaas and reverse-proxy sections
describe the new default and when to narrow it to the proxy alone.

Model: opus-5-5

internal/middleware/ratelimit.go

@@ -123,9 +123,8 @@ func bucketKey(addr netip.Addr) string {
 	return prefix.String()
 }
 
-// isTrustedProxy reports whether addr belongs to a network the
-// operator listed in TRUSTED_PROXIES. The list is empty by default,
-// so by default nothing is trusted.
+// isTrustedProxy reports whether addr belongs to a network in
+// TRUSTED_PROXIES, which by default is the RFC 1918 private ranges.
 func (m *Middleware) isTrustedProxy(addr netip.Addr) bool {
 	for _, prefix := range m.params.Config.TrustedProxies {
 		if prefix.Contains(addr) {