fix: quote X-Forwarded-For header_up to avoid Caddy v2 replace mode dropping headers

- Both /api/* and catch-all handlers now use quoted Caddy placeholder
  syntax (e.g. "{http.request.header.X-Forwarded-For}") so Caddy evaluates
  them in 'set' mode instead of failing silently in 'replace' mode.
- demo-service-caddy.yaml ConfigMap: also added missing X-Forwarded-For
  header_up in the catch-all handler (was entirely absent).

home-apps/demo-service-caddy.yaml

@@ -32,7 +32,7 @@ data:
         handle /api/* {
             reverse_proxy localhost:3000 {
                 header_up Host {host}
-                header_up X-Forwarded-For {http.request.header.X-Forwarded-For}, {remote_host}
+                header_up X-Forwarded-For "{http.request.header.X-Forwarded-For}, {remote_host}"
                 header_up X-Forwarded-Proto https
             }
         }
@@ -51,6 +51,7 @@ data:
             rewrite * /site-content{uri}
             reverse_proxy localhost:3000 {
                 header_up Host {host}
+                header_up X-Forwarded-For "{http.request.header.X-Forwarded-For}"
                 header_up X-Forwarded-Proto https
                 header_up Cookie {http.request.header.Cookie}
             }

home-apps/demo-service/Caddyfile

@@ -25,7 +25,7 @@
     handle /api/* {
         reverse_proxy localhost:3000 {
             header_up Host {host}
-            header_up X-Forwarded-For {http.request.header.X-Forwarded-For}, {remote_host}
+            header_up X-Forwarded-For "{http.request.header.X-Forwarded-For}, {remote_host}"
             header_up X-Forwarded-Proto https
         }
     }
@@ -44,6 +44,7 @@
         rewrite * /site-content{uri}
         reverse_proxy localhost:3000 {
             header_up Host {host}
+            header_up X-Forwarded-For "{http.request.header.X-Forwarded-For}"
             header_up X-Forwarded-Proto https
             header_up Cookie {http.request.header.Cookie}
         }