fix: update gRPC service configuration to use CmsServerBaseUrl resolver

- Replace direct access to configuration for GwUrl with CmsServerBaseUrl.Resolve in AddGrpcServices and TokenNotificationService.
- Ensure proper error handling for missing GwUrl and add support for optional bypass of public TLS using CmsInternalBaseUrl.
- Adjust channel credentials based on whether the base URL is HTTPS or not.

k8s/staging/frontoffice-deployment.yaml

@@ -0,0 +1,59 @@
+---
+# FrontOffice (Blazor Server) — staging. Server-side gRPC/SignalR to CMS: set CmsInternalBaseUrl to the
+# in-cluster Service URL so TLS is not terminated on a broken public chain (PartialChain).
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: frontoffice
+  namespace: default
+  labels:
+    app: frontoffice
+    environment: staging
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: frontoffice
+  template:
+    metadata:
+      labels:
+        app: frontoffice
+    spec:
+      containers:
+        - name: frontoffice
+          image: 194.5.195.53:30080/admin/frontoffice:latest
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 80
+              name: http
+          env:
+            - name: ASPNETCORE_ENVIRONMENT
+              value: "Staging"
+            - name: CmsInternalBaseUrl
+              value: "http://cms-svc:8080"
+          resources:
+            requests:
+              memory: "256Mi"
+              cpu: "250m"
+            limits:
+              memory: "512Mi"
+              cpu: "500m"
+      imagePullSecrets:
+        - name: gitea-registry-secret
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: frontoffice-svc
+  namespace: default
+  labels:
+    app: frontoffice
+spec:
+  selector:
+    app: frontoffice
+  ports:
+    - port: 80
+      targetPort: 80
+      name: http
+  type: ClusterIP