Trust reverse proxy headers to fix mixed-content asset URLs

Behind the prod TLS-terminating proxy, Laravel only saw the internal
HTTP hop and generated http:// URLs for Vite assets, which browsers
block as mixed content on an https:// page (suivicpt.trankil.net).

Configured trustProxies in bootstrap/app.php to honor X-Forwarded-*
headers, defaulting to trust any upstream (TRUSTED_PROXIES env var
to restrict to a specific IP if the app is ever reachable directly
over HTTP). .env.production reference updated with the real APP_URL
and the new TRUSTED_PROXIES setting.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

bootstrap/app.php

@@ -4,6 +4,7 @@ use App\Http\Middleware\EnsureHouseholdSelected;
 use Illuminate\Foundation\Application;
 use Illuminate\Foundation\Configuration\Exceptions;
 use Illuminate\Foundation\Configuration\Middleware;
+use Illuminate\Http\Request;
 
 return Application::configure(basePath: dirname(__DIR__))
     ->withRouting(
@@ -15,6 +16,20 @@ return Application::configure(basePath: dirname(__DIR__))
         $middleware->alias([
             'household' => EnsureHouseholdSelected::class,
         ]);
+
+        // Behind a reverse proxy (nginx/Caddy) terminating TLS, Laravel only
+        // sees the internal HTTP hop unless it trusts X-Forwarded-* headers —
+        // otherwise every generated URL (including @vite asset URLs) comes
+        // back as http:// and gets blocked as mixed content on an https:// page.
+        $trustedProxies = env('TRUSTED_PROXIES', '*');
+
+        $middleware->trustProxies(
+            at: $trustedProxies === '*' ? '*' : array_filter(explode(',', (string) $trustedProxies)),
+            headers: Request::HEADER_X_FORWARDED_FOR
+                | Request::HEADER_X_FORWARDED_HOST
+                | Request::HEADER_X_FORWARDED_PORT
+                | Request::HEADER_X_FORWARDED_PROTO,
+        );
     })
     ->withExceptions(function (Exceptions $exceptions) {
         //