bookstack: APP_PROXIES=172.16.0.0/12 — the login throttle per visitor (R-753; decision 59 revisited now that the box passes each visitor)

Checklist 3.6 re-measured on 9202 through the simulated tunnel (felhom.eu audits/visitors-2026-10-01/A/bookstack-3.6.txt):
without it, a stranger's 5 wrong tries for admin@admin.com throttled the household from another address too; with it,
the stranger is throttled and the household signs in at once. A rotating forged leftmost address does not escape.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

templates/bookstack/docker-compose.yml

@@ -26,6 +26,10 @@ services:
       - DB_PASSWORD=${DB_PASSWORD}
       - DB_DATABASE=bookstack
       - APP_KEY=${APP_KEY}
+      # R-753 (controller >= 0.286.0): trust the docker networks as proxies, so Laravel walks X-Forwarded-For from the
+      # RIGHT and keys its login throttle on each VISITOR (tunnel: the real address; LAN: the LAN client). Measured on
+      # 9202: without it a stranger's 5 wrong tries throttled the household too; with it only the stranger.
+      - APP_PROXIES=172.16.0.0/12
       - APP_URL=https://${SUBDOMAIN}.${DOMAIN}
     volumes:
       - bookstack_config:/config