fix(helm): treat TRUST_PROXY_HEADERS as chart-computed on both deployments

It is inlined on the app container like PII_URL, so it has to be in the
$chartComputed lists. It was not, which meant setting the documented
app.env.TRUST_PROXY_HEADERS override under externalSecrets.enabled failed
template validation and demanded a remoteRefs mapping for a value the container
never reads from a Secret. It also wrote the key into the chart-managed Secret.

Inline it on the realtime deployment too. @sim/audit runs there and reads this
to decide whether a forwarded header may be believed when stamping an audit
row's ipAddress, and the chart-managed Secret is shared with realtime via
envFrom — so excluding the key from that Secret without inlining it would have
quietly left realtime trusting headers the operator declared untrustworthy.

Verified by rendering: inline, existingSecret, and ESO modes each emit exactly
one entry per pod carrying the same value, the key never reaches the Secret,
and ESO no longer demands a remoteRef for it.

Author: waleedlatif1

helm/sim/templates/_helpers.tpl

@@ -313,7 +313,7 @@ than enforced.
 {{- define "sim.validateExternalSecretCoverage" -}}
 {{- if and .Values.externalSecrets .Values.externalSecrets.enabled -}}
 {{- $remoteRefs := default (dict) (default (dict) .Values.externalSecrets.remoteRefs).app -}}
-{{- $chartComputed := list "DATABASE_URL" "SOCKET_SERVER_URL" "OLLAMA_URL" "PII_URL" -}}
+{{- $chartComputed := list "DATABASE_URL" "SOCKET_SERVER_URL" "OLLAMA_URL" "PII_URL" "TRUST_PROXY_HEADERS" -}}
 {{- $appEnv := default (dict) .Values.app.env -}}
 {{/*
   Required-key coverage: these are non-optional at runtime. With ESO enabled

helm/sim/templates/deployment-app.yaml

@@ -121,7 +121,7 @@ spec:
               and in inline mode (values flow through the chart-managed Secret).
             */}}
             {{- if and .Values.app.secrets.existingSecret.enabled (not .Values.externalSecrets.enabled) }}
-            {{- $chartComputed := list "DATABASE_URL" "SOCKET_SERVER_URL" "OLLAMA_URL" "PII_URL" }}
+            {{- $chartComputed := list "DATABASE_URL" "SOCKET_SERVER_URL" "OLLAMA_URL" "PII_URL" "TRUST_PROXY_HEADERS" }}
             {{- range $key, $value := $appEnv }}
             {{- if and (ne (toString $value) "") (ne (toString $value) "<nil>") (not (has $key $chartComputed)) }}
             - name: {{ $key }}

helm/sim/templates/deployment-realtime.yaml

@@ -62,6 +62,15 @@ spec:
           env:
             - name: DATABASE_URL
               value: {{ include "sim.databaseUrl" . | quote }}
+            {{- /*
+              Inlined for the same reason as on the app pod: @sim/audit runs here
+              too and reads this to decide whether a forwarded header may be
+              believed when stamping an audit row's ipAddress. Chart-computed, so
+              it is excluded from the shared Secret and must be set explicitly on
+              both deployments.
+            */}}
+            - name: TRUST_PROXY_HEADERS
+              value: {{ include "sim.trustProxyHeaders" . | quote }}
             {{- if .Values.telemetry.enabled }}
             {{- $nodeEnv := default (default "production" (index (.Values.realtime.envDefaults | default dict) "NODE_ENV")) (index (.Values.realtime.env | default dict) "NODE_ENV") }}
             # OpenTelemetry configuration
@@ -112,7 +121,7 @@ spec:
               deployment.
             */}}
             {{- if and .Values.app.secrets.existingSecret.enabled (not .Values.externalSecrets.enabled) }}
-            {{- $chartComputed := list "DATABASE_URL" "SOCKET_SERVER_URL" "OLLAMA_URL" "PII_URL" }}
+            {{- $chartComputed := list "DATABASE_URL" "SOCKET_SERVER_URL" "OLLAMA_URL" "PII_URL" "TRUST_PROXY_HEADERS" }}
             {{- /*
               Build the effective realtime env from app.env as the base, then
               overlay non-empty realtime.env values. Sprig's `merge` keeps the

helm/sim/templates/secrets-app.yaml

@@ -18,7 +18,7 @@ metadata:
     {{- include "sim.app.labels" . | nindent 4 }}
 type: Opaque
 stringData:
-  {{- $chartComputed := list "DATABASE_URL" "SOCKET_SERVER_URL" "OLLAMA_URL" "PII_URL" }}
+  {{- $chartComputed := list "DATABASE_URL" "SOCKET_SERVER_URL" "OLLAMA_URL" "PII_URL" "TRUST_PROXY_HEADERS" }}
   {{- /*
     Intent: app.env is authoritative for shared keys (both pods envFrom this
     Secret, so the app container must not be silently overwritten by a