feat(networking): add proxy-aware origin handling

[tintinhamans]

Adds optional reverse-proxy support while preserving direct hosting. Existing Kestrel HTTP/HTTPS endpoints and certificate handling remain supported and unchanged.

When TrustedProxies is empty, forwarded headers are ignored and Services continues using the connection’s direct client IP, scheme, and host.

---

When enabled, trusted proxies may provide:

• X-Forwarded-For for the original client IP
• X-Forwarded-Proto for the public scheme
• X-Forwarded-Host for the public host and port
• X-Forwarded-Prefix for a public path prefix

Trusted proxies can be configured using individual IPv4/IPv6 addresses and CIDR networks:

"TrustedProxies": [
  "10.0.0.10",
  "10.20.0.0/16",
  "2001:db8:1234::/48"
]

"*" trusts forwarded headers from every sender. It is exclusive and cannot be combined with IP addresses or CIDR networks:

"TrustedProxies": ["*"]

This should only be used when Services is network-isolated and reachable exclusively through the reverse proxy.

---

WebSocket URLs are derived from the effective request instead of hardcoded addresses. Direct HTTP and HTTPS continue producing ws:// and wss:// URLs respectively.

For example, a proxied request to https://api.playgenerals.online produces wss://api.playgenerals.online/ws.

---

AllowedOrigins configures which browser origins may use the HTTP API and WebSocket endpoint:

"AllowedOrigins": [
  "https://admin.playgenerals.online",
  "https://*.playgenerals.online"
]

Explicit origins support credentials and wildcard subdomains.

"*" allows every origin without credentials. It is exclusive and cannot be combined with explicit origins:

"AllowedOrigins": ["*"]

An empty list denies browser-origin access. Native clients (e.g. game clients) that omit the Origin header remain supported.

---

The HTTPS Kestrel endpoint is no longer mandatory. Deployments may continue serving HTTPS directly or optionally run HTTP-only behind a TLS-terminating proxy.