The responseEnvelopeMiddleware already wraps all res.json() calls in
{success, data, meta}. The tool-policies routes were manually wrapping
too, causing result.data to be {success, data:[...]} instead of [...].
This crashed the ToolPoliciesTab: policies.map is not a function.
Resolves#100. Adds configurable trust proxy setting via TRUST_PROXY
environment variable. Supports numeric hop counts, subnet strings, and
named values (loopback, linklocal, uniquelocal). TRUST_PROXY=true is
intentionally blocked (unsafe for production — logs warning and falls
back to default). Disabled by default (no behavior change).
Includes documentation updates for nginx, Caddy, and Docker deployments.
