feat(security): add trusted proxies and abuse event cleanup

- Add `WARPBOX_TRUSTED_PROXIES` configuration to restrict accepted forwarded client IP headers to specific proxy IPs/CIDRs, securing client IP resolution.
- Integrate `BanService` into the background cleanup job to automatically purge expired abuse and ban evidence events.
- Update documentation with reverse proxy security guidelines and a production systemd deployment guide.

backend/libs/jobs/jobs.go

@@ -16,14 +16,14 @@ type job struct {
 	run      func()
 }
 
-func StartAll(cfg config.Config, logger *slog.Logger, uploadService *services.UploadService) func() {
+func StartAll(cfg config.Config, logger *slog.Logger, uploadService *services.UploadService, banService *services.BanService) func() {
 	if !cfg.JobsEnabled {
 		logger.Info("background jobs disabled", "source", "jobs", "severity", "dev")
 		return func() {}
 	}
 
 	stops := []func(){
-		start(newCleanupJob(cfg, logger, uploadService), logger),
+		start(newCleanupJob(cfg, logger, uploadService, banService), logger),
 		start(newThumbnailsJob(cfg, logger, uploadService), logger),
 	}