fix: default TRUST_PROXY to 1 for Docker+reverse-proxy setups (#46)

With the previous default of 'loopback', Express ignored X-Forwarded-Proto
headers from Caddy/nginx when running in Docker (bridge IP, not loopback).
This caused req.secure=false, which made express-session silently drop the
session cookie on login - resulting in a 401 on every subsequent request.

Changing the default to 1 (trust one proxy hop) fixes this for all standard
Docker+reverse-proxy deployments without requiring manual configuration.

docker-compose.yml

@@ -13,7 +13,10 @@ services:
     environment:
       - NODE_ENV=production
       - DB_PATH=/data/oikos.db
-      # Set to false when not using HTTPS/reverse proxy (direct HTTP access)
+      # Reverse proxy setup (Caddy, nginx, Traefik):
+      #   - Remove SESSION_SECURE=false (default is true)
+      #   - TRUST_PROXY is automatically set to 1 (trust one proxy hop)
+      # Direct HTTP access (no reverse proxy):
       - SESSION_SECURE=false
     healthcheck:
       test: ["CMD", "node", "-e", "require('http').get('http://localhost:3000/health', r => process.exit(r.statusCode === 200 ? 0 : 1))"]