fix: respect FORWARDED_ALLOW_IPS environment variable in start.sh

[xr843]

Summary

• start.sh hardcodes --forwarded-allow-ips '*' in both the HuggingFace Space path and the main uvicorn startup, ignoring the FORWARDED_ALLOW_IPS environment variable documented in .env.example
• This change reads FORWARDED_ALLOW_IPS from the environment with '*' as the default fallback, preserving full backward compatibility while allowing users to restrict forwarded IPs as intended

Fixes #22539

Test plan

• Default behavior unchanged (* when env var not set)
• Set FORWARDED_ALLOW_IPS=127.0.0.1 and verify uvicorn uses the custom value

🤖 Generated with Claude Code

contributor license agreement

[pr-validator-bot]

🚫 STOP

@xr843, you are trying to merge to the main branch!

This repository does not allow direct merges to the main branch! Please retarget your PR to the dev branch ASAP or your PR will be closed!

---

🚫 STOP: MISSING CLA

@xr843, your PR description is missing the Contributor License Agreement confirmation.
Please use the PR template when creating your pull request. The template includes the required CLA text and helps ensure you provide all necessary information.
The CLA is absolutely required for ALL PRs. Your PR will be closed due to the missing CLA.
You can find more information about our CLA in the repository documentation, the /docs repository, the PR template and the contributing guideline.

---

👋 Welcome and Thank You for Contributing!

We appreciate you taking the time to submit a pull request to Open WebUI!

⚠️ Important: Testing Requirements

We've recently seen an increase in PRs that have significant issues:

• PRs that don't actually fix the bug they claim to fix
• PRs that don't implement the feature they describe
• PRs that break existing functionality
• PRs that are clearly AI-generated without proper testing being done by the author
• PRs that simply don't work as intended

These untested PRs consume significant time from maintainers and volunteer contributors who review and test PRs in their free time.
Time that could be spent testing other PRs or improving Open WebUI in other ways.

Before marking your PR as "Ready for Review":

Please explicitly confirm:

1. ✅ You have personally tested ALL changes in this PR
2. ✅ How you tested it (specific steps you took to verify it works)
3. ✅ Visual evidence where applicable (screenshots or videos showing the feature/fix working) - if applicable to your specific PR

If you're not certain your PR works exactly as intended, please leave it in DRAFT mode until you've thoroughly tested it.

Thank you for helping us maintain quality and respecting the time of our community! 🙏

[xr843]

Closing to retarget to dev branch with proper PR template.