0 historically meant a session cookie; null now expresses that explicitly.
0 is still accepted for BC but emits a deprecation notice.

When the application runs from the command line (cron, tasks, MCP server),
$_SERVER carries no host, so the request URL was meaningless and everything
derived from it (%baseUrl%, LinkGenerator, template $baseUrl, assets) broke.

The base URL is used only when no host can be detected from the environment,
so a web application on any domain keeps working without changes.

http:
baseUrl: https://example.com/

The path/domain defaulting used truthy checks, so an explicit '' (a host-only
cookie or an empty path) behaved as if the argument was omitted: the cookie
inherited cookiePath instead of widening to '/', or cookieDomain instead of
staying host-only. Only null now means "not given".

Changes the configured default of `proxyHeaders` from "both" to "xForwarded",
so an application behind a proxy no longer trusts a client-supplied "Forwarded"
header by default (the common proxy sets X-Forwarded-For). The RequestFactory
PHP default is intentionally left at "both" for BC; this hardens only the
framework configuration.

BC: deployments whose proxy uses the "Forwarded" header must now set
`proxyHeaders: forwarded` (or `both`).

Adds a choice of which forwarding headers to trust from a trusted proxy:
setProxy() gains $forwarded and $xForwarded flags, and the DI extension
exposes it as `proxyHeaders: both|xForwarded|forwarded|none`, mapped to the
two flags. Lets a deployment ignore a header its proxy does not manage (e.g.
a client-supplied "Forwarded" while the proxy only sets "X-Forwarded-For").

Default stays "both" (Forwarded preferred) — no behaviour change.

Resolves the real client address, scheme and host from forwarding headers
correctly and consistently for both "Forwarded" and "X-Forwarded-*":

- Parses "Forwarded" into RFC 7239 hops instead of flattening "," and ";"
together, so proto/host are taken from the same hop as the selected client
address (removes the crude single-value guard that discarded them on any
multi-hop header).
- Picks the client address by stripping trailing trusted proxies and taking
the rightmost remaining hop, instead of blindly trusting the leftmost,
client-spoofable "for" value.
- Validates the resolved address as an IP; an unknown/obfuscated identifier
or a broken chain now yields null instead of a non-IP string. The stripping
and validation is shared by both paths via findClientHop().

Note: as before, this trusts whatever forwarding header the request carries.
The trusted proxy must set the header it uses and strip any client-supplied
forwarding header it does not, otherwise a passed-through header (e.g. a
client "Forwarded" while the proxy only manages "X-Forwarded-For") is trusted.

BC: getRemoteAddress() now returns null (not a non-IP string) when the
innermost forwarded value is not a valid IP address.

Promotes the optional @method to a required method, so User no longer needs method_exists() to call it. BC break: existing IdentityHandler implementations must now declare getGuestIdentity().

Until now __get() returned null for an unknown key and, because it returns
by reference, silently created that key in the data (and thus in the storage).
It now throws MemberAccessException, like any other Nette object.

This also ends the by-ref write pattern $identity->cart[] = $item on a key
that has not been set yet.

Identity class must exist as an alias in order to read it from session