docs/SECURITY.md doesn't name TRUST_PROXY_HEADERS or TRUSTED_PROXY_HOPS, the two env vars that control rate-limit bucket keying

## What

docs/SECURITY.md explains that rate limit buckets are keyed on caller supplied data, but never names the two env vars that control exactly that.

## Where

docs/SECURITY.md:329:

```
- **Rate limiting is per process and every bucket is keyed on something the caller supplies.** See
[`docs/BACKLOG.md`](./BACKLOG.md), entries H11 and H13.
```

`TRUST_PROXY_HEADERS` and `TRUSTED_PROXY_HOPS` (.env.example, around lines 619 to 634) are exactly the configuration that decides what that "something" is. A wrong `TRUSTED_PROXY_HOPS` value is a real, security relevant misconfiguration: it can let an attacker spoof which rate limit bucket they land in, and it also affects the "ip" field recorded in the audit log.

## Expected

docs/SECURITY.md names both env vars next to this bullet and states the risk of misconfiguring them.

## How to fix

1. Read the comments above `TRUSTED_PROXY_HOPS` and `TRUST_PROXY_HEADERS` in .env.example, they already explain the risk clearly.
2. Add a sentence or two to the bullet at docs/SECURITY.md:329 naming both vars and summarizing that risk in your own words.

## How to check

Someone reading docs/SECURITY.md's known limitations list learns which two env vars control rate limit bucket keying, without already knowing to check .env.example.

Read the comments for TRUSTED_PROXY_HOPS and TRUST_PROXY_HEADERS in .env.example, then update the rate-limiting bullet at docs/SECURITY.md:329. Done means the security document names both variables and explains the risk of misconfiguration so readers can identify how bucket keying and the audit-log IP are affected.

Written by the indexing model from the issue text.