feat(serve-http): GBRAIN_TRUST_PROXY env var + Supabase deploy docs

[knee5]

Summary

Two small changes for gbrain serve --http users deploying behind PaaS load balancers:

1. GBRAIN_TRUST_PROXY env var — src/commands/serve-http.ts makes the Express trust-proxy setting configurable. Default unchanged ('loopback'); set GBRAIN_TRUST_PROXY=1 for Fly.io/Render/Railway/Vercel where the real client IP arrives after exactly one hop. Required for both rate-limiting (correct client IPs) and req.secure detection (OAuth flows).

2. Supabase Deployment Caveat docs — docs/mcp/DEPLOY.md adds a new section covering the three env vars external Supabase deployments need (GBRAIN_DISABLE_DIRECT_POOL=1, GBRAIN_POOL_SIZE=1, GBRAIN_TRUST_PROXY=1), the pooler URL gotcha (port 6543 not 5432), and a minimal Fly.io fly.toml example.

Why

Tested against a Supabase-backed brain on a self-hosted VPS. Without these flags + docs, the startup sequence wedges on an IPv6 connect to db.<project-ref>.supabase.co:5432 (unreachable from outside Supabase's VPC), and rate-limiting silently misclassifies clients because app.set('trust proxy', 'loopback') only trusts 127.0.0.1. After applying both, gbrain serve --http runs cleanly.

Replaces #759

This is the focused remainder of #759. That PR also bundled DCR /register rate-limiter changes; those landed independently via the v0.31 fix-wave (#776 et al). #760 also got incidentally fixed by the same fix-wave (the engine.connect() call you added to phaseBBackfill/phaseCVerify covers what we'd patched). So #759 is closed and only the trust-proxy + Supabase docs remain — narrower scope, cleaner review.

Test plan

• tsc --noEmit passes
• Default behavior unchanged when GBRAIN_TRUST_PROXY is unset
• Manual smoke test: setting GBRAIN_TRUST_PROXY=1 correctly resolves to integer 1 (not the string)
• Docs render cleanly on GitHub

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith with what you need.}

• Let Codesmith autofix CI failures and bot reviews