feat: complete Epic 1 production foundation

docs/schemas/runtime-config.schema.json

@@ -182,7 +182,7 @@
       "unit": null,
       "default": null,
       "required": true,
-      "minimum": null,
+      "minimum": 32,
       "maximum": null,
       "sensitivity": "secret",
       "mode": "effective",
@@ -300,6 +300,21 @@
         "deny entries override allow entries"
       ]
     },
+    {
+      "semantic_path": "outbound.max_request_bytes",
+      "env_name": "CRANK_OUTBOUND_MAX_REQUEST_BYTES",
+      "process": "shared",
+      "value_type": "u64",
+      "unit": "bytes",
+      "default": "4194304",
+      "required": false,
+      "minimum": 1,
+      "maximum": 67108864,
+      "sensitivity": "public",
+      "mode": "effective",
+      "compatibility": null,
+      "rules": []
+    },
     {
       "semantic_path": "outbound.max_response_bytes",
       "env_name": "CRANK_OUTBOUND_MAX_RESPONSE_BYTES",
@@ -719,15 +734,33 @@
       "process": "admin_api",
       "value_type": "bool",
       "unit": null,
-      "default": "false",
+      "default": null,
       "required": false,
       "minimum": null,
       "maximum": null,
       "sensitivity": "public",
-      "mode": "effective",
-      "compatibility": "yes/no/on/off spellings are deprecated",
+      "mode": "deprecated_no_effect",
+      "compatibility": "deprecated boolean proxy trust; use CRANK_TRUSTED_PROXY_IPS",
       "rules": []
     },
+    {
+      "semantic_path": "admin.trusted_proxy_ips",
+      "env_name": "CRANK_TRUSTED_PROXY_IPS",
+      "process": "admin_api",
+      "value_type": "ip_list",
+      "unit": null,
+      "default": "",
+      "required": false,
+      "minimum": null,
+      "maximum": null,
+      "sensitivity": "internal",
+      "mode": "effective",
+      "compatibility": null,
+      "rules": [
+        "only listed immediate peer IPs may supply X-Real-IP/X-Forwarded-For client identity",
+        "empty value disables forwarded-header trust"
+      ]
+    },
     {
       "semantic_path": "admin.bootstrap.email",
       "env_name": "CRANK_BOOTSTRAP_ADMIN_EMAIL",
@@ -750,12 +783,12 @@
       "value_type": "secret",
       "unit": null,
       "default": null,
-      "required": true,
+      "required": false,
       "minimum": null,
       "maximum": null,
       "sensitivity": "secret",
       "mode": "effective",
-      "compatibility": null,
+      "compatibility": "deprecated startup-bootstrap password; use local bootstrap contract",
       "rules": []
     },
     {