Add trusted proxy client metadata

[durck]

Summary

Adds trusted reverse proxy support for client metadata and webhook payloads.

Details

• Adds --trusted-proxy-cidr to trust X-Real-IP and X-Forwarded-For only from configured proxy CIDRs.
• Accepts repeated or comma-separated CIDR/IP values; plain IP values are normalized to /32 or /128.
• Carries connection metadata through mux wrappers, WebSocket, and HTTP polling transports.
• Adds optional client state fields for transport, public key fingerprint, and proxy source IP.

Validation

• go test ./pkg/mux ./internal/server/observers ./cmd/server
• go test -vet=off ./cmd/server ./internal/server
• git diff --check