Satisfy gosec on the proxy count and the request log

G115: the trusted-proxy count is stored as an int64 instead of narrowing
it to int32. G706: the request logger and serverError quote the request
method and route; the logger's remaining taint comes from the wrapped
response writer, so it carries a justified nosec like the other quoted log
lines.

Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN

internal/api/router.go

@@ -23,7 +23,7 @@ func NewRouter(db *sql.DB, notify NotifyConfig, cfg config.Config, version strin
 	// One limiter each, both process-wide for the life of the router: login
 	// counts failed passwords, sign-up counts account creation, and mixing the
 	// two would let a burst of sign-ups lock somebody out of logging in.
-	trustedProxies.Store(int32(cfg.TrustedProxies))
+	trustedProxies.Store(int64(cfg.TrustedProxies))
 	loginLimit := newLoginLimiter(db)
 	signupLimiter := newLoginLimiter(db)
 	oidcLimit := newLoginLimiter(db)