fix(security): trim TRUSTED_PROXIES entries and document the var

Whitespace after commas in TRUSTED_PROXIES produced invalid IP/CIDR
entries; trim each. Document the variable in .env.production.example so
proxy deployments configure it instead of silently losing the real
client IP (which also makes the new per-IP throttles spoofable).

.env.production.example

@@ -14,6 +14,14 @@ APP_LOCALE=en
 APP_FALLBACK_LOCALE=en
 APP_FAKER_LOCALE=en_US
 
+# Trusted Proxies
+# Comma-separated proxy IPs/CIDRs Laravel trusts for X-Forwarded-* headers (no spaces).
+# Required when running behind a reverse proxy (Coolify/Traefik, nginx, Cloudflare):
+# without it the app cannot see the real client IP (rate limiting breaks and becomes
+# spoofable) nor detect HTTPS (redirect loops). The private ranges below cover the
+# Docker network the proxy connects from; leave unset only when there is no proxy.
+TRUSTED_PROXIES=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
+
 # Logging
 LOG_CHANNEL=stack
 LOG_STACK=single,sentry_logs

bootstrap/app.php

@@ -33,7 +33,7 @@ return Application::configure(basePath: dirname(__DIR__))
         $trustedProxies = env('TRUSTED_PROXIES');
 
         $middleware->trustProxies(
-            at: is_string($trustedProxies) ? explode(',', $trustedProxies) : null,
+            at: is_string($trustedProxies) ? array_map('trim', explode(',', $trustedProxies)) : null,
             headers: Request::HEADER_X_FORWARDED_FOR
                 | Request::HEADER_X_FORWARDED_HOST
                 | Request::HEADER_X_FORWARDED_PORT