A forwarding header shorter than the hop count is read from its leftmost entry

At Trusted proxy hops 2 (Cloudflare → Traefik → app), a LAN request reaching
Traefik directly carries one X-Forwarded-For entry. trusted_entry returned None
for it, so every LAN visitor was filed under Traefik's overlay address in the
throttles and the audit log. Cloudflare's single X-Forwarded-Proto: https read
as plain HTTP, so the public road lost the Secure cookie and HSTS.

A short header now clamps to its leftmost entry, the one the first proxy wrote,
as family canon #5004 does in Minstrel, Librarian and Forge. A caller's own
entries can only make the header longer, so this trusts nothing more than before.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_proxy.py

@@ -41,13 +41,21 @@ def test_two_hops_sees_past_a_cdn():
     assert forwarded_for("1.2.3.4, 203.0.113.7, 172.16.0.5", PEER, 2) == "203.0.113.7"
 
 
-def test_a_short_header_falls_back_rather_than_reaching_left():
-    # Fewer proxies than configured: the socket address, rather than an entry no
-    # proxy of ours wrote.
-    assert forwarded_for("203.0.113.7", PEER, 2) == PEER
+def test_a_short_header_is_read_from_its_leftmost_entry():
+    # Fewer proxies than configured — a LAN visitor straight to our proxy, behind a
+    # count set for the CDN road. The leftmost entry is what the first proxy wrote; a
+    # caller's own entries could only have made the header longer. Falling back to the
+    # socket address here would file every LAN visitor under the proxy's address.
+    assert forwarded_for("192.168.0.20", PEER, 2) == "192.168.0.20"
     assert forwarded_for("", PEER, 1) == PEER
 
 
+def test_a_single_https_from_the_cdn_counts_at_two_hops():
+    # Cloudflare sends one `X-Forwarded-Proto: https` and our proxy passes it on
+    # without appending, so at hops 2 it is a one-entry header — and still HTTPS.
+    assert trusted_entry("https", 2) == "https"
+
+
 def test_malformed_headers_do_not_crash_or_leak_empties():
     assert forwarded_for(",,,", PEER, 1) == PEER
     assert forwarded_for("  ,  203.0.113.7  ,  ", PEER, 1) == "203.0.113.7"