Upgrade to kaya 0.0.3 with trusted-proxy forwarded header support

- bump kaya-core/kaya-rsgi to >= 0.0.3 and add kaya-forwarded: forwarded
  header handling is no longer built into core, it is opt-in via
  ForwardedHeadersMixin and gated on trusted proxy CIDRs
- add TRUSTED_PROXY_CIDRS setting (comma-separated CIDRs, validated at
  startup; empty means no proxy is trusted) and wire the mixin in app.py
- cover trusted/untrusted peers, all-trusted chains and the RFC 7239
  Forwarded header with port in the test suite
- document the new variable in README, .env.example and docker-compose.yml

README.md

@@ -9,6 +9,7 @@ over the RSGI protocol.
 
 - **kaya-core** — routing and HTTP request/response handling
 - **kaya-rsgi** — Granian (RSGI) adapter
+- **kaya-forwarded** — trusted-proxy handling of `Forwarded` / `X-Forwarded-*` headers
 - **granian** — application server
 - **rloop** — Rust event loop used by Granian instead of the stdlib asyncio loop
 - **httpx + pwo** — test client over kaya's ASGI transport
@@ -36,8 +37,12 @@ The `/all` field order mirrors the reference site: `ip_addr`,
 `keep_alive`, `method`, `encoding`, `mime`, `charset`, `via`, `forwarded`.
 
 The reported client IP/port honor the `Forwarded`, `X-Forwarded-For`,
-`X-Forwarded-Host` and `X-Forwarded-Port` proxy headers (kaya ≥ 0.0.2);
-without them the socket peer address is used.
+`X-Forwarded-Host` and `X-Forwarded-Port` proxy headers **only when the
+direct peer belongs to one of the `TRUSTED_PROXY_CIDRS`** (see
+[Configuration](#configuration)); the header chain is walked right-to-left
+skipping trusted proxies, so spoofed entries prepended by the client are
+never selected. Without trusted proxies configured, or when the peer is
+untrusted, the socket peer address is used.
 
 Example:
 
@@ -80,6 +85,7 @@ Environment variables (see `.env.example`):
 | Variable | Default | Description |
 |---|---|---|
 | `SITE_NAME` | `pyfconfig` | Public name used in the HTML page title and the curl examples (set to your domain, e.g. `ifconfig.example.com`) |
+| `TRUSTED_PROXY_CIDRS` | *(empty)* | Comma-separated CIDRs/IPs of trusted reverse proxies (e.g. `127.0.0.1,10.0.0.0/8`). Forwarded headers are honored only from these peers; empty means no proxy is trusted |
 
 The bind address is configured through Granian itself (`GRANIAN_HOST` /
 `GRANIAN_PORT` env vars or `--host` / `--port` CLI flags).