lk-jwt-service returns 500 on /sfu/get with private DNS + self-signed cert

**Describe the bug**

Element X voice/video calls fail with OPEN_ID_ERROR when the Matrix homeserver uses private DNS and self-signed certificates. The error comes from lk-jwt-service's /sfu/get endpoint returning HTTP 500.

lk-jwt-service logs:

Failed to look up user info: Get "matrix:///_matrix/federation/v1/openid/userinfo?access_token=...": dial tcp: lookup on 10.43.0.10:53: no such host

After making the domain resolvable inside the cluster, the error changes to:

Failed to look up user info: context deadline exceeded (Client.Timeout exceeded while awaiting headers)

**To Reproduce**

Deploy ESS Helm chart (matrix-stack-26.7.1) with ingress.tlsEnabled: false, private DNS, self-signed certificates
Log into Element X
Initiate a voice or video call
See OPEN_ID_ERROR in Element X, and the above logs in lk-jwt-service
Expected behavior

/sfu/get returns a LiveKit JWT and URL, and the call proceeds normally.

**Environment**

lk-jwt-service 0.4.4
ESS Helm chart matrix-stack-26.7.1
Synapse v1.157.1
k3s v1.36.2
Traefik ingress (k3s default), ingress.tlsEnabled: false
Additional context