Add Tailscale Ingress and enable forwarded headers middleware

Add Tailscale Ingress resource to k8s/deployment.yaml for TLS-terminated
access via calendar-mcp.tail920062.ts.net. Enable UseForwardedHeaders in
Program.cs so X-Forwarded-Proto/Host are trusted from reverse proxies.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: rockfordlhotka

k8s/deployment.yaml

@@ -78,3 +78,25 @@ spec:
       name: http
   selector:
     app: calendar-mcp
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: calendar-mcp-tailscale
+  annotations:
+    tailscale.com/hostname: calendar-mcp
+spec:
+  ingressClassName: tailscale
+  tls:
+    - hosts:
+        - calendar-mcp.tail920062.ts.net
+  rules:
+    - http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: calendar-mcp
+                port:
+                  number: 8080

src/CalendarMcp.HttpServer/Program.cs

@@ -4,6 +4,7 @@
 using CalendarMcp.HttpServer.BlazorAdmin;
 using Microsoft.AspNetCore.Authentication.Cookies;
 using Microsoft.AspNetCore.Components.Authorization;
+using Microsoft.AspNetCore.HttpOverrides;
 using OpenTelemetry.Logs;
 using OpenTelemetry.Resources;
 using Scalar.AspNetCore;
@@ -150,6 +151,11 @@ public static void Main(string[] args)
 
         var app = builder.Build();
 
+        // Trust forwarded headers from reverse proxies (e.g., Tailscale Ingress)
+        app.UseForwardedHeaders(new ForwardedHeadersOptions
+        {
+            ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto
+        });
         app.MapStaticAssets();
         app.UseAuthentication();
         app.UseAuthorization();