fix: trust ingress forwarded headers

[Linxiushen]

Summary

• trust ingress proxy headers by default in the service container
• let Uvicorn honor X-Forwarded-Proto: https from in-cluster ingress addresses so canonical redirects keep the HTTPS scheme
• use the FORWARDED_ALLOW_IPS environment variable so direct deployments can override the default with specific trusted proxy IPs or CIDRs

Validation

• confirmed Uvicorn resolves Config.forwarded_allow_ips to * from the container environment
• git diff --check

Fixes #245

Disclosure: This change was prepared with AI assistance. I reviewed the configuration and validated Uvicorn's environment handling.

[all-hands-bot]

👋 This PR needs a couple of things fixed before OpenHands can review it:

• the PR description's HUMAN: section needs at least 20 characters describing what you tested, not just the template placeholder

Push an update once this is addressed and this check re-runs automatically.

This is an automated check - no AI was used to generate this comment.