- docs/advanced/config/optional-config.md: TRUSTED_PROXY_* env table + security note
- docker-compose.yml: commented trusted-header SSO env block
- .env.example: full example env incl trusted-header SSO section
Makes the reverse-proxy SSO fully configurable via .env / docker-compose, and
documents the trust model (shared secret is the boundary; fails closed).
Authored By: Culpur Defense Inc.