Write restored PHI 0o600 and let TRUST_PROXY_HOPS reach the container

Two findings from the docs truth audit, both operator-facing.

scripts/restore-backup.ts wrote the decrypted backup, which is health
data in plaintext, with the process default file mode, leaving it
world-readable on the operator's disk while it sat there. It is now
written 0o600.

TRUST_PROXY_HOPS is read from the environment to size the trusted
X-Forwarded-For chain, but it was absent from the compose environment
whitelist, so an operator value in .env never reached the container and
was silently ignored. It now rides all four surfaces: the compose
whitelist, both env examples, and the manifest that pnpm check-env
reads.

.env.example

@@ -169,6 +169,12 @@ API_TOKEN_HMAC_KEY="REPLACE-WITH-OUTPUT-OF-openssl-rand-hex-32"
 # regex- and length-bounded), but the gating decision is up to the
 # operator — there is no way for the server to detect whether the flag
 # matches the real deployment topology. When in doubt, leave it off.
+# Number of trusted reverse-proxy hops in front of the app. The client IP is
+# read that many entries from the right of the X-Forwarded-For chain. Leave
+# unset for a directly-exposed host; set to 1 behind a single reverse proxy.
+# A wrong value makes the app refuse to read XFF and share one rate-limit
+# bucket across all anonymous callers.
+# TRUST_PROXY_HOPS="1"
 # TRUST_CF_CONNECTING_IP=""