Trust reverse proxy headers to fix mixed-content on the subdomain

App is served behind a reverse proxy that terminates TLS and forwards
plain HTTP to nginx on :8001. Without TrustProxies, Laravel couldn't
see the original request was HTTPS, so Livewire generated an http://
update endpoint on an https:// page — browsers block that as mixed
active content. Trusting proxy headers fixes URL generation while
leaving direct LAN http:// access on :8001 unaffected.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

bootstrap/app.php

@@ -13,7 +13,11 @@ return Application::configure(basePath: dirname(__DIR__))
         health: '/up',
     )
     ->withMiddleware(function (Middleware $middleware): void {
-        //
+        // Behind a reverse proxy (nginx serves plain HTTP on :8001; TLS is
+        // terminated in front of it), so trust X-Forwarded-* headers —
+        // otherwise Laravel/Livewire generate http:// URLs even when the
+        // original request was https, tripping mixed-content blocking.
+        $middleware->trustProxies(at: '*');
     })
     ->withExceptions(function (Exceptions $exceptions): void {
         $exceptions->shouldRenderJsonWhen(