Add externalTrafficPolicy to CaddyConfig for client IP preservation

[Cre-eD]

Problem

GKE Autopilot L4 LoadBalancer with default externalTrafficPolicy: Cluster performs SNAT on incoming traffic. The real client IP is lost — Caddy sees only internal GKE node IPs in REMOTE_ADDR, and X-Forwarded-For contains 10.x.x.x instead of the actual user IP.

The recently added trustedProxies tells Caddy to trust XFF from known proxies, but it doesn't help when the L4 LB strips the real IP before it reaches Caddy.

Fix

Adds externalTrafficPolicy field to CaddyConfig. When set to "Local", the L4 LoadBalancer routes traffic directly to the node running the Caddy pod, preserving the original source IP.

Changes

• pkg/clouds/k8s/types.go — ExternalTrafficPolicy *string field on CaddyConfig
• pkg/clouds/pulumi/kubernetes/deployment.go — pass through Args → SimpleContainerArgs
• pkg/clouds/pulumi/kubernetes/caddy.go — read from CaddyConfig and pass to Args
• pkg/clouds/pulumi/kubernetes/simple_container.go — serviceSpec() helper that sets ExternalTrafficPolicy on the k8s Service when provided

Usage

# server.yaml
caddy:
  enable: true
  externalTrafficPolicy: "Local"
  trustedProxies:
    - "10.0.0.0/8"
    - "173.245.48.0/20"

Both trustedProxies and externalTrafficPolicy: Local are needed together:

• externalTrafficPolicy: Local — preserves real IP at L4 LB level
• trustedProxies — tells Caddy to trust XFF headers from those IPs

Notes

• Only applies when service type is LoadBalancer (default for Caddy)
• With Local policy, traffic only routes to nodes with Caddy pods. GKE Autopilot handles this correctly with health checks.
• Manually tested on PAY-SPACE production — client IPs now correctly appear in application logs