pub fn loopback_trust_header() -> String
X-Real-IP / X-Forwarded-For with private/loopback IP — some applications grant elevated trust to loopback. Cache key isn’t affected.