[forkger]

Docs for kmworks/kmrs#398 (server.trusted-proxies).

• Configuration: the new key in the full key reference, same line as examples/config.toml.
• Enhancements, Security and authentication: the behavior difference. X-Forwarded-For names the client address only when the request comes from a listed reverse proxy, where Java takes its first address from anyone. By default the list holds loopback and the private ranges, so a proxy on the same host, in a container network or on the LAN works without configuration. The entry also says that a configured list replaces the default (a proxy on a public address has to be listed, trusted-proxies = [] (KOMGA_TRUSTED_PROXIES=none in the environment) ignores the header from everyone) and that the first ignored header is logged once as a warning.
• Limitations: server.forward-headers-strategy was listed as ignored but behavior-equivalent ("always framework"). That is no longer exact for X-Forwarded-For, so the entry now says so and links to the enhancements section.

pnpm build and nimbus-docs check pass with no findings.