fix: trust staging-ca in container to resolve PartialChain gRPC error

Add staging-ca.crt to the Dockerfile so the ASP.NET runtime inside the
container trusts the internal staging CA. This fixes server-side gRPC
calls from FrontOffice (Blazor Server) to https://cms.se.kbs1.ir which
were failing with PartialChain because the container CA store did not
include the staging root certificate.

Also adds GW_URL env support alongside GwUrl for parity with BackOffice.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/FrontOffice.Main/Dockerfile

@@ -20,10 +20,12 @@ FROM 194.5.195.53:32082/dotnet/aspnet:9.0 AS runtime
 WORKDIR /app
 COPY --from=build /app/publish .
 
+# Trust the staging-ca so server-side gRPC calls to https://cms.se.kbs1.ir succeed without PartialChain
+COPY ["FrontOffice.Main/staging-ca.crt", "/usr/local/share/ca-certificates/staging-ca.crt"]
+RUN update-ca-certificates
+
 ENV ASPNETCORE_URLS=http://+:80
 ENV GW_URL=https://cms.se.kbs1.ir
-# For Kubernetes staging, override GW_URL/GwUrl to http://cms-svc:8080 via deployment env vars
-# to avoid TLS PartialChain when the public ingress cert is not trusted by the container.
 EXPOSE 80
 
 ENTRYPOINT ["dotnet", "FrontOffice.Main.dll"]