fix: trust staging-ca in container to resolve PartialChain gRPC error

Add staging-ca.crt to the Dockerfile so the ASP.NET runtime inside the
container trusts the internal staging CA. This fixes server-side gRPC
calls from FrontOffice (Blazor Server) to https://cms.se.kbs1.ir which
were failing with PartialChain because the container CA store did not
include the staging root certificate.

Also adds GW_URL env support alongside GwUrl for parity with BackOffice.

Co-authored-by: Cursor <cursoragent@cursor.com>

k8s/staging/frontoffice-deployment.yaml

@@ -29,9 +29,9 @@ spec:
             - name: ASPNETCORE_ENVIRONMENT
               value: "Staging"
             - name: GW_URL
-              value: "http://cms-svc:8080"
+              value: "https://cms.se.kbs1.ir"
             - name: GwUrl
-              value: "http://cms-svc:8080"
+              value: "https://cms.se.kbs1.ir"
           resources:
             requests:
               memory: "256Mi"

src/FrontOffice.Main/Dockerfile

@@ -20,10 +20,12 @@ FROM 194.5.195.53:32082/dotnet/aspnet:9.0 AS runtime
 WORKDIR /app
 COPY --from=build /app/publish .
 
+# Trust the staging-ca so server-side gRPC calls to https://cms.se.kbs1.ir succeed without PartialChain
+COPY ["FrontOffice.Main/staging-ca.crt", "/usr/local/share/ca-certificates/staging-ca.crt"]
+RUN update-ca-certificates
+
 ENV ASPNETCORE_URLS=http://+:80
 ENV GW_URL=https://cms.se.kbs1.ir
-# For Kubernetes staging, override GW_URL/GwUrl to http://cms-svc:8080 via deployment env vars
-# to avoid TLS PartialChain when the public ingress cert is not trusted by the container.
 EXPOSE 80
 
 ENTRYPOINT ["dotnet", "FrontOffice.Main.dll"]

src/FrontOffice.Main/staging-ca.crt

@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIIC9jCCAd6gAwIBAgIQAwobM2pDCheGeQdvVZzMPTANBgkqhkiG9w0BAQsFADAV
+MRMwEQYDVQQDEwpzdGFnaW5nLWNhMB4XDTI2MDQyODE5MjU0NVoXDTM2MDQyNTE5
+MjU0NVowFTETMBEGA1UEAxMKc3RhZ2luZy1jYTCCASIwDQYJKoZIhvcNAQEBBQAD
+ggEPADCCAQoCggEBALOOLPxgHegrkI9YXm/0wHKchE5ukb8omv2oDYPp/CjQn8yJ
+KBpn+8tev8wT1SECACNuA3XhxtjV9dryV5U6lxkmQv2YlLrJOFa3ljcODQpAkKXl
+Q+PMWic2VyO9/UkW1a4HcPQfGhpgN710evOfBFB4Ora4CUVsADKPLbjJfX8jpqkU
+LAZiQCrA1kJ087fiKheuXEAWPgcwEE5q0BCs876zIHyST6FaLVNabM5/m0sr7Bky
+1GQCJlgOLtUeDkaXAv/WJqq/LetcjNy2dWS26PJc7C2byShTfaaWDM8Ki5FG/uMQ
+/6L54Lx5QKGbl8MzIKmEscXe4GYnmE8MyHQX0aECAwEAAaNCMEAwDgYDVR0PAQH/
+BAQDAgKkMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFELZSJbeWDRQgj6cTQWY
+K2sT9ZsLMA0GCSqGSIb3DQEBCwUAA4IBAQCT2eGmHcd1t4K80NobrUzm1d3SB4EW
+XOLCR+TTYFIYsim0eltwzrOuch+MBTf4+v+4zXWE4e7d1B1lzJIqFIXcgLpDu0i2
+QeZMrPxY1rkUhqGPwwsoOWBIK/cGot2yg6SZEwj64f7lKUbUB8aWY+xSzct2mwlG
+i0j6wt0/eRh6hKGdvEiYORffdubC94utkNzr0kFszY4yb3vG0zCVWYiGzkxe0IiF
+Gc8zN8ZHTY9tk+G5wQuj2WAo7M3DXgFWBbhNgharKulEXTxLXhQksw/nXITa2IwM
+qt4MWHdGn7/iIyUp/774ySkFk2n6cHi7gQAvolT6OZNCuAOYm8+No7P6
+-----END CERTIFICATE-----