fix: trusted-proxies config for X-Forwarded-For rate limiting (L-2)

[jkyberneees]

Closes L-2.

Changes:

• Add TrustedProxies config field (file: trusted_proxies, env: ODEK_TRUSTED_PROXIES, CLI: --trusted-proxies).
• Update clientIP in cmd/odek/serve.go to only honor X-Forwarded-For / X-Real-Ip when the direct remote address is in the trusted list.
• Add isTrustedProxy helper supporting exact IPs and CIDR ranges.
• Wire trusted proxies through wsHandshakeWithLimits and handleSessionByID.
• Update test helpers and existing tests to pass the new parameter.
• Add regression tests for clientIP behavior and config loading from env/CLI/file.
• Update AGENTS.md and docs/SECURITY.md.

Tested with go test ./... -count=1.