fix(traefik): trust X-Forwarded-* from RFC1918 sources

Real visitor IPs were lost behind the cloudflared tunnel: traefik
saw the cloudflared container's docker IP as the client and ignored
its X-Forwarded-For. Trust RFC1918 on web + websecure so XFF from
the docker bridges (and the LAN) is honored.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

infra/traefik/traefik.yml

@@ -13,8 +13,18 @@ metrics:
 entryPoints:
   web:
     address: ":80"
+    forwardedHeaders:
+      trustedIPs:
+        - "10.0.0.0/8"
+        - "172.16.0.0/12"
+        - "192.168.0.0/16"
   websecure:
     address: ":443"
+    forwardedHeaders:
+      trustedIPs:
+        - "10.0.0.0/8"
+        - "172.16.0.0/12"
+        - "192.168.0.0/16"
   dns:
     address: ":53/udp"