docs: changelog 0.3.3 (proxy trust, peer redaction, price-history query)

Document the merged hardening PRs and bump version:
- restrict trusted proxy headers via TRUSTED_PROXY_CIDRS (#16)
- redact public peer topology from /api/peers (#17)
- single bounded price-history query (no findOne fan-out) (#15)

Also note the TRUSTED_PROXY_CIDRS deployment requirement in the README.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: NateIsern

CHANGELOG.md

@@ -5,6 +5,25 @@ All notable changes to the FairCoin Explorer are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.3] - 2026-06-25
+
+### Security
+
+- **Restrict trusted proxy headers.** `X-Forwarded-*` is now trusted only when the
+  direct TCP peer is an explicitly configured proxy (`TRUSTED_PROXY_CIDRS`), instead
+  of a blind single-hop trust, so a direct client cannot spoof its IP and bypass the
+  per-IP rate limiter. The WebSocket per-IP cap uses the same trust decision (#16).
+- **Redact public peer topology.** `GET /api/peers` no longer exposes raw peer
+  addresses, client versions, or per-peer metadata (#17).
+
+### Changed
+
+- **Price history sampling is a single bounded query.** `fetchBoundedPriceHistory`
+  loads the (two-tier-pruned, bounded) point set once and thins it in memory,
+  removing the per-request `findOne` fan-out introduced earlier (#15).
+
+[0.3.3]: https://github.com/FairCoinOfficial/Explorer/releases/tag/v0.3.3
+
 ## [0.3.2] - 2026-06-25
 
 ### Security

README.md

@@ -70,7 +70,9 @@ WEBSOCKET_MAX_CONNECTIONS_PER_IP=5
 PUBLIC_BASE_URL=https://explorer.fairco.in
 ```
 
-**Security**: RPC credentials are only read server-side; all RPC calls are proxied through the API. The `/api` surface is rate-limited (a global limiter on `/api`, plus stricter limits on `/api/search`, `/api/tx/broadcast`, and the public `/mcp` endpoint, which can drive daemon-backed wallet tools). Expensive lookups are bounded: `/api/price/history` samples long windows with indexed queries instead of full-range scans, and `/api/search` on an address returns balance only (it no longer triggers an unbounded address-txid scan, so `txCount` is `0` there — use the address pages for full history).
+**Security**: RPC credentials are only read server-side; all RPC calls are proxied through the API. The `/api` surface is rate-limited (a global limiter on `/api`, plus stricter limits on `/api/search`, `/api/transaction`, `/api/address`, `/api/tx/broadcast`, and the public `/mcp` endpoint, which can drive daemon-backed wallet tools). Expensive lookups are bounded: `/api/price/history` samples long windows in memory from a bounded, two-tier-pruned series, and `/api/search` on an address returns balance only (it no longer triggers an unbounded address-txid scan, so `txCount` is `0` there — use the address pages for full history). `/api/peers` is redacted (no raw peer addresses or topology).
+
+Behind a reverse proxy (e.g. nginx/Cloudflare), set `TRUSTED_PROXY_CIDRS` to the proxy's IP/CIDR(s) so the rate limiter keys on the real client IP — `X-Forwarded-For` is trusted **only** from those peers, never from arbitrary clients. Leave it blank when the API is reached directly.
 
 ## API overview
 

package.json

@@ -1,7 +1,7 @@
 {
   "name": "faircoin-explorer",
   "private": true,
-  "version": "0.3.2",
+  "version": "0.3.3",
   "type": "module",
   "scripts": {
     "dev": "vite",