docs: D1 Operations/Rate limiting and D2 env reference (README)

Close documentation-plan findings 1-3 and part of 10: panel operations
guide, two-level rate limits, public env table with TRUSTED_PROXY_CIDR
warning, and compose wiring for the proxy CIDR variable.

Co-authored-by: Cursor <cursoragent@cursor.com>

deploy/.env.example

@@ -1,4 +1,5 @@
 # Copy to .env next to docker-compose.yml and fill in.
+# Full reference: README "Environment variables".
 
 # Required — the container refuses to start without it. Hostname used both for
 # the panel's TLS vhost and for Postfix's SASL realm (SASL_REALM defaults to

deploy/docker-compose.yml

@@ -45,6 +45,10 @@ services:
       # report what the internet sees rather than what this host's own stub
       # resolver synthesises. Empty uses public defaults.
       SELFPOST_DNS_RESOLVERS: "${SELFPOST_DNS_RESOLVERS:-}"
+      # Reverse-proxy CIDRs allowed to supply X-Forwarded-For for login/setup
+      # rate-limiting. See README "Environment variables" — wrong value lets a
+      # client spoof its rate-limit key.
+      TRUSTED_PROXY_CIDR: "${TRUSTED_PROXY_CIDR:-}"
     volumes:
       # All persistent state lives under /data (spec 9): SQLite DB, DKIM keys,
       # sasldb2, sender map, setup token. Back this up (panel button or the