feat(security): add trusted proxies and abuse event cleanup

- Add `WARPBOX_TRUSTED_PROXIES` configuration to restrict accepted forwarded client IP headers to specific proxy IPs/CIDRs, securing client IP resolution.
- Integrate `BanService` into the background cleanup job to automatically purge expired abuse and ban evidence events.
- Update documentation with reverse proxy security guidelines and a production systemd deployment guide.

backend/templates/pages/download.html

@@ -7,8 +7,8 @@
       <div class="file-emblem" aria-hidden="true">
         <svg viewBox="0 0 24 24" role="img" focusable="false"><path d="M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8Z" /><path d="M14 2v6h6" /></svg>
       </div>
-      <h1 id="download-title">{{if .Data.Locked}}Protected box{{else}}Download files{{end}}</h1>
-      <p class="download-subtitle">Bucket id: {{.Data.Box.ID}}</p>
+      <h1 id="download-title">{{if .Data.Locked}}Protected box{{else}}Box: {{.Data.Box.ID}} ({{len .Data.Files}} file{{if ne (len .Data.Files) 1}}s{{end}}){{end}}</h1>
+      {{if .Data.Locked}}<p class="download-subtitle">Bucket id: {{.Data.Box.ID}}</p>{{end}}
 
       {{if .Data.Locked}}
         <form class="unlock-form" action="/d/{{.Data.Box.ID}}/unlock" method="post">
@@ -25,7 +25,7 @@
 
       {{if .Data.Files}}
         <div class="badge-row">
-          <span class="badge">Expires {{.Data.ExpiresLabel}}</span>
+          <span class="badge badge-expiry">Expires {{.Data.ExpiresLabel}}</span>
           {{if .Data.MaxDownloads}}<span class="badge">{{.Data.DownloadCount}} / {{.Data.MaxDownloads}} downloads</span>{{end}}
         </div>