fix(auth) : bind Sudloh sessions and stop OAuth redirect loops

k8s/base/configmap.yaml

@@ -10,8 +10,9 @@ data:
   SUDLOH_OIDC_ISSUER: https://account.sudloh.com/api/auth
   SUDLOH_OIDC_REDIRECT_URI: https://guide.sudloh.com/api/auth/callback/sudloh
   SUDLOH_OIDC_ONLY: "true"
-  # Traefik must overwrite this header; do not expose the app directly.
-  TRUSTED_CLIENT_IP_HEADER: x-real-ip
+  # Traefik supplies X-Forwarded-For and does not trust incoming forwarded headers.
+  # The network policy allows only Traefik to reach the app.
+  TRUSTED_CLIENT_IP_HEADER: x-forwarded-for
   DATABASE_POOL_SIZE: "10"
   HEALTHCHECK_TIMEOUT_MS: "2500"
   NEXT_DEPLOYMENT_ID: replace-me