docs(security): forwarded-headers trusted-proxy config (TrustedProxyOptions)

[marcelo-maciel]

Documents the forwarded-headers / trusted-proxy change from starter-kit PR #1334 (honor X-Forwarded-* behind a reverse proxy; trust bound to a new TrustedProxyOptions).

Changes

• Changelog (## 2026-07-13): the real-client-IP fix — why it matters (rate-limit buckets collapsing, useless audit IPs), the TrustedProxyOptions trust model, and the action-required note (set your ingress CIDRs/hop count, secure-by-default otherwise).
• CORS & security headers: new Reverse proxy & forwarded headers section documenting TrustedProxyOptions (KnownProxies / KnownNetworks / ForwardLimit) and the trust boundary, plus UseForwardedHeaders added to the pipeline-order slice (it now runs first, right after the exception handler).
• Production checklist: item 6 (HTTPS everywhere) now notes that honoring X-Forwarded-Proto requires TrustedProxyOptions, with the config snippet and a link to the new section.

No new checklist item added — the checklist stays a ten-item gate; the proxy-trust guidance lives inside the existing HTTPS item.

Depends on / pairs with starter-kit #1334.

[iammukeshm]

Reviewed - the TrustedProxyOptions docs read well and match the shape of upstream #1334. Holding the merge until #1334 actually lands (it's still open), since the site documents the kit as shipped. Two notes for the rebase when it does: (1) main's changelog em dashes were converted to hyphens site-wide, and your entry should get its own dated section matching the upstream merge date rather than joining ## 2026-07-13; (2) #235's forwarded-headers bullet was intentionally not applied, so this PR is the sole changelog source for that fix.