Under the default, a client with a private address picks its own rate-limit key through X-Forwarded-For whether it connects directly or through the proxy, so the README and the TrustedProxies comment now tell an operator with any such clients to set the list to the proxy alone. The login endpoint section no longer assumes the proxy is uncovered by default. Model: opus-5-5