Fix Headlamp OIDC callback URL generation

Set HEADLAMP_CONFIG_BASE_URL to https://headlamp.basicstack.de to ensure
the OIDC callback URL is generated correctly with HTTPS scheme. When
running behind Traefik without explicit base URL, Headlamp may generate
http:// callback URLs instead of https://, causing OIDC flow failures.

Also added traefik.ingress.kubernetes.io/preserve-host annotation to
ensure proper header forwarding.

Fixes: DEV-324

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/headlamp/deployment.yaml

@@ -27,7 +27,7 @@ spec:
           protocol: TCP
         env:
         - name: HEADLAMP_CONFIG_BASE_URL
-          value: ""
+          value: "https://headlamp.basicstack.de"
         - name: HEADLAMP_CONFIG_OIDC_IDP_ISSUER_URL
           value: https://auth.basicstack.de
         - name: HEADLAMP_CONFIG_OIDC_CLIENT_ID

apps/headlamp/ingress.yaml

@@ -6,6 +6,7 @@ metadata:
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
     traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+    traefik.ingress.kubernetes.io/preserve-host: "true"
 spec:
   ingressClassName: traefik
   rules: