Trust the RFC 1918 ranges as proxies when TRUSTED_PROXIES is unset (closes #333)

Unset or empty, TRUSTED_PROXIES now defaults to 10.0.0.0/8,
172.16.0.0/12 and 192.168.0.0/16, so a reverse proxy reaching the app
over a Docker network or a private LAN gets per-client rate-limit
buckets without configuration. A set value replaces the default; an
unparseable one still fails startup.

The startup warning for an empty list goes, with its test hook and
test, since the default is no longer empty. The README's
configuration table, Trusted proxies, upaas and reverse-proxy sections
describe the new default and when to narrow it to the proxy alone.

Model: opus-5-5

internal/server/routes.go

@@ -140,11 +140,12 @@ func (s *Server) setupPageRoutes() {
 		r.Use(s.mw.NoCache())
 
 		// The login POST carries no pre-emptive rate limiter. Behind
-		// the reverse proxy production requires, with TRUSTED_PROXIES
-		// unset, every client shares one bucket, so a limiter spent
-		// on arrival lets any stranger deny the operator the only
-		// administrative path. The handler verifies credentials first
-		// and charges only failures; see Handlers.authenticateUser.
+		// the reverse proxy production requires, when TRUSTED_PROXIES
+		// does not cover it, every client shares one bucket, so a
+		// limiter spent on arrival lets any stranger deny the operator
+		// the only administrative path. The handler verifies
+		// credentials first and charges only failures; see
+		// Handlers.authenticateUser.
 		r.Get("/login", s.h.HandleLoginPage())
 		r.Post("/login", s.h.HandleLoginSubmit())