z.coerce.boolean() evaluates Boolean(value), coercing 'false' and '0' to true. Setting TRUST_PROXY=false inadvertently enabled proxy trust, allowing spoofed X-Forwarded-For headers to bypass login brute-force throttling and unsubscribe limits.
Align parsing with PIPELINE_FUSED: only 'true' or '1' enable proxy trust, defaulting to false when unset.