Upgrade to kaya 0.0.3 with trusted-proxy forwarded header support

- bump kaya-core/kaya-rsgi to >= 0.0.3 and add kaya-forwarded: forwarded
  header handling is no longer built into core, it is opt-in via
  ForwardedHeadersMixin and gated on trusted proxy CIDRs
- add TRUSTED_PROXY_CIDRS setting (comma-separated CIDRs, validated at
  startup; empty means no proxy is trusted) and wire the mixin in app.py
- cover trusted/untrusted peers, all-trusted chains and the RFC 7239
  Forwarded header with port in the test suite
- document the new variable in README, .env.example and docker-compose.yml

tests/__init__.py

@@ -1,6 +1,13 @@
 """Test package init.
 
-pyfconfig's settings all have safe defaults, so no environment overrides
-are required before importing :mod:`pyfconfig.app`; this file exists so
-``python -m unittest discover -s tests -t .`` treats tests as a package.
+``TRUSTED_PROXY_CIDRS`` must be set before :mod:`pyfconfig.config` is first
+imported because settings are read from the environment at import time.
+The ASGI transport used by the tests presents ``127.0.0.1`` as the socket
+peer, so it is trusted here together with ``10.0.0.0/8`` to exercise the
+right-to-left trusted-proxy chain walk.
 """
+from __future__ import annotations
+
+import os
+
+os.environ.setdefault("TRUSTED_PROXY_CIDRS", "127.0.0.1,10.0.0.0/8")