Set FORWARDED_ALLOW_IPS so request.url gets the right scheme behind the load balancer #393

request.url is http on deployed environments, because TLS is terminated at the load balancer and the container is spoken to over http. gunicorn's UvicornWorker only trusts X-Forwarded-Proto from forwarded_allow_ips, which defaults to loopback, so the header is ignored and the scheme is wrong everywhere a URL is built from the request.

#392 works around it for the one case that was visible — the Scalar OAuth redirect URL, which was handing Auth0 an http:// callback on dev — by reading X-Forwarded-Proto directly. Anything else deriving a URL from request.url still has it.

Setting FORWARDED_ALLOW_IPS on the container fixes it properly and lets the workaround come back out. It's a deployment change rather than a code one, hence a separate issue.