#7614 fix: trust forwarded client IPs only behind configured proxies

Summary

Fixes #7601. router.session.client_ip previously trusted the leftmost X-Forwarded-For value, which clients can spoof.

The connection peer address is now used by default. Applications behind trusted reverse proxies can set trusted_proxy_hops to select the client address from the forwarded chain.

Changes

• Add trusted_proxy_hops, defaulting to 0; reject negative and non-integer values.
• Use the configured hop count to read the address from the right side of X-Forwarded-For. Fall back to the connection peer if the header is missing or too short.
• Document the setting and its proxy-trust requirements.
• Add regression tests and changelog entries for reflex and reflex-base.

Testing

• tests/units/test_app.py and tests/units/test_config.py: 350 passed, 2 skipped
• Pyright, Ruff, and codespell passed