fix(security): harden authentication and outbound targets (#1877)

* fix(security): harden auth and outbound targets

* fix(security): prevent login lockout and honor trusted schemes

.env.example

@@ -44,6 +44,12 @@ API_POLLING_RATE_LIMIT=300
 # trailing slash. When unset, enrollment falls back to the request Host.
 SENCHO_PUBLIC_URL=
 
+# Comma-separated CIDRs of reverse proxies trusted to set forwarding headers.
+# Set a single IPv4 proxy as a /32, a single IPv6 proxy as a /128, or use the
+# proxy network CIDR when Sencho is behind one (for example, 192.168.1.50/32).
+# Unset or invalid values make Sencho ignore forwarded client and scheme data.
+SENCHO_TRUSTED_PROXY_CIDRS=
+
 # ─── Pilot agent (remote host only) ──────────────────────────────
 # These three vars are required ONLY on a remote host running as a
 # pilot-agent reverse-tunnel container. The primary instance does not
@@ -53,11 +59,6 @@ SENCHO_PUBLIC_URL=
 # this unset.
 SENCHO_MODE=
 
-# Comma-separated CIDRs of reverse proxies trusted to set X-Forwarded-Proto
-# for Pilot Agent TLS termination. Unset or invalid: non-TLS Pilot upgrades are
-# treated as non-confidential and hub registry credential delivery is skipped.
-SENCHO_TRUSTED_PROXY_CIDRS=
-
 # WebSocket-capable URL of the controlling Sencho instance. Use https://
 # scheme; the agent rewrites it to wss:// for the tunnel upgrade.
 SENCHO_PRIMARY_URL=