fix(k8s): keep Keycloak's backchannel URLs https behind the labs Caddy (refs #177)

KC_HOSTNAME_BACKCHANNEL_DYNAMIC builds the token/userinfo/certs URLs from the
request, which reaches Keycloak as plain http through the proxy, so browsers
blocked them as mixed content after login. Trust X-Forwarded-Proto.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

infra/helm/big-reference/values.yaml

@@ -286,6 +286,11 @@ workloads:
       # Only rendered with demo.otpAutofill (big.env skips empty values); off, Keycloak
       # keeps its stock theme and the mounted big-demo theme is unused.
       KC_SPI_THEME_DEFAULT: '{{ if .Values.demo.otpAutofill }}big-demo{{ end }}'
+      # Behind a TLS proxy (keycloakUrl) the dynamic backchannel URLs — token,
+      # userinfo, certs — take their scheme from the request, which reaches Keycloak
+      # as plain http; trusting X-Forwarded-Proto keeps them https so the browser
+      # doesn't block them as mixed content. In-cluster calls send no such header.
+      KC_PROXY_HEADERS: xforwarded
     ports: [{ name: http, port: 8080 }]
     # TCP, not /health/ready on the management port: nothing here gates on realm
     # import, and a wrong health path would leave the Service with no endpoints.