Plan the readability refactor, and clear the tree for it

Phase 17 splits the four files that hold most of the code, finishes the
schema migration SP8 left half done, and stops the published guide from
drifting away from its Markdown source. `plan/17-refactor.md` carries the
plan and the progress table, and `plan/STATUS.md` points at it.

Stage 0 is hygiene only. Both abandoned worktrees are gone, which freed
about 104 MB. Removing `sp7-tree-ui` needed one extra step: a Vite dev
server had been running out of it since 2026-08-18, holding
`frontend/.vite` open and owning port 5173, and serving a tree 54 commits
behind `main`. The three stale `.db` files are deleted; `data.db` is not.

`AIDND_TRUSTED_PROXY_HOPS` is now documented. It was read at `limits.py:55`
and named in no `.env.example`, README, or blueprint. It sets how many
proxy hops the rate limiter trusts in `X-Forwarded-For`, so a deployment
that adds a hop without setting it gets the bucket-rotation bypass back.

The 19 squash-landed branches are still there. `git branch -D` is blocked
by the permission classifier; the verified command is in the plan file.

549 tests pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014Dix4oGV3njgWRdu7P9t6r

README.md

@@ -267,6 +267,12 @@ that takes about 30 to 60 seconds to wake it. Point any keep-warm pinger at `/ap
 which deliberately doesn't touch the database: waking the database around the clock costs far
 more than the cold start saves.
 
+If you put another proxy or CDN in front of Render, set `AIDND_TRUSTED_PROXY_HOPS` to the
+number of proxies in the chain. It defaults to 1. The rate limiter reads the client IP that
+many entries from the right of `X-Forwarded-For`, because the trusted edge appends the real
+one last. Leave it at 1 behind two proxies and the limiter reads an entry the caller
+supplied, so anyone can rotate the header for a fresh rate-limit bucket per request.
+
 ## Repo notes
 
 - `plan/` holds the phased implementation plan this project was built from, kept as a build