chore: bump version to v0.16.3

[hsinatfootprintai]

Summary

Patch release rolling up the PROXY protocol work merged in #105–#108:

• feat(sentinel): preserve real client IP via PROXY protocol v2 #105: Sentinel emits PROXY v2 when --proxy-protocol is set; encoder + Go-level e2e + real-Caddy e2e (build-tag gated) + new CI workflow.
• feat(daemon): wire --proxy-protocol flags into Caddy startup (srv0 only) #106: Daemon srv0 wrapper — --proxy-protocol and --proxy-protocol-trusted flags; EnableProxyProtocol uses atomic getFullConfig+loadConfig to preserve other server fields.
• feat(daemon): caddy-l4 PROXY protocol — wrapping-aware lifecycle #107: Daemon caddy-l4 wrapping-aware lifecycle (pattern B) — EnableL4ProxyProtocol, wrapping-aware getRoutes/putRoutes, regression test for the RouteSyncJob interaction.
• docs: PROXY protocol — preserving the real client IP #108: Architecture documentation at docs/PROXY-PROTOCOL.md + scrub of identifying values.

End-to-end verified in production: previously-loopback X-Forwarded-For at the upstream container is now the real public client IP, and TLS-passthrough SNI routes (gRPC etc.) keep working under PROXY through the wrapped caddy-l4 server.

Diff

• pkg/version/version.go: 0.16.2 → 0.16.3
• CHANGELOG.md: new [0.16.3] entry under Added, summarising the four PRs

Test plan

• go build ./... clean
• containarium version reports 0.16.3 after build
• No additional test changes (the substantive features are already merged on main with full coverage)

🤖 Generated with Claude Code