Set FORWARDED_ALLOW_IPS so request.url gets the right scheme behind the load balancer

request.url is http on deployed environments, because TLS is terminated at the load balancer and the container is spoken to over http. gunicorn's UvicornWorker only trusts X-Forwarded-Proto from forwarded_allow_ips, which defaults to loopback, so the header is ignored and the scheme is wrong everywhere a URL is built from the request.

#392 works around it for the one case that was visible — the Scalar OAuth redirect URL, which was handing Auth0 an http:// callback on dev — by reading X-Forwarded-Proto directly. Anything else deriving a URL from request.url still has it.

Setting FORWARDED_ALLOW_IPS on the container fixes it properly and lets the workaround come back out. It's a deployment change rather than a code one, hence a separate issue.

Start by locating the container or deployment configuration where environment variables are set for the deployed API. Set FORWARDED_ALLOW_IPS there and verify that request.url uses the forwarded scheme behind the load balancer. Confirm that the workaround from #392 can then be removed without breaking the Scalar OAuth redirect URL.