Improve proxy deployment guidance for self-hosted users

[JSvandijk]

Why this matters

The optional HTTPS proxy is useful, but it is easy for self-hosted users to misunderstand where it is safe to run and where it should not be exposed.

The current guidance is spread across README.md, SECURITY.md, docs/SECURITY-AUDIT.md, and the release/publishing docs. The repo should make the deployment boundaries obvious to a new reader before they cargo-cult a risky setup.

Scope

• Tighten the deployment guidance for the optional proxy.
• Add a short, concrete checklist for trusted-network assumptions and "do not expose this like a hardened public edge" cases.
• Keep the guidance consistent across README, security docs, and release/publishing docs.

Acceptance criteria

• A new self-hosted user can quickly tell when the proxy is appropriate and when it is not.
• The docs explicitly call out public-internet exposure risks and trusted-certificate expectations.
• The guidance is consistent across the main public-facing docs.
• No claims in the docs overstate the proxy's security posture.

Notes

This is partly documentation, but it directly reduces support risk and security misunderstanding.

[JSvandijk]

Maintenance check on May 5, 2026 after merging #19 and #20.

Current state:

• SECURITY.md clearly says the project is for Tailscale/trusted private networks, not a hardened public internet gateway.
• README.md says HTTPS is preferred, HTTP is only for Tailscale/trusted networks, and the proxy exposes GET /__t3mobile/health for troubleshooting.
• docs/SECURITY-AUDIT.md calls out optional proxy operator discipline and says the project should not claim hardened public-internet deployment.

Keeping this open because the acceptance criteria asked for a short concrete deployment checklist, and that still is not consolidated in one place. The next useful update is a small proxy deployment checklist linked from README/SECURITY rather than more scattered prose.

[JSvandijk]

Closed by #21.

[JSvandijk]

Fixed by #21.

docs/PROXY-DEPLOYMENT.md now gives the proxy a concrete deployment checklist covering:

• appropriate trusted-network use
• unsafe public exposure cases
• minimum setup for T3_TARGET, PUBLIC_URL, TLS files, and PROXY_HTTP=true
• verification steps for GET /__t3mobile/health, upstream status, TLS/path expectations, and no leaked paths/tokens

The checklist is linked from README.md and SECURITY.md, and docs/SECURITY-AUDIT.md now records this as a May 5 maintenance update.