fix: update gRPC service configuration to use CmsServerBaseUrl resolver

- Replace direct access to configuration for GwUrl with CmsServerBaseUrl.Resolve in AddGrpcServices and TokenNotificationService.
- Ensure proper error handling for missing GwUrl and add support for optional bypass of public TLS using CmsInternalBaseUrl.
- Adjust channel credentials based on whether the base URL is HTTPS or not.

src/FrontOffice.Main/ConfigureServices.cs

@@ -100,7 +100,9 @@ public static class ConfigureServices
 
     public static IServiceCollection AddGrpcServices(this IServiceCollection services, IConfiguration configuration)
     {
-        var baseUrl = configuration["GwUrl"];
+        var baseUrl = CmsServerBaseUrl.Resolve(configuration)
+            ?? throw new InvalidOperationException(
+                "GwUrl is required. Optionally set CmsInternalBaseUrl (e.g. http://cms-svc:8080 on Kubernetes) to bypass public TLS for server-side gRPC.");
 
         // Register optimized HttpClient for gRPC
         services.AddScoped(sp =>
@@ -158,6 +160,7 @@ public static class ConfigureServices
         var httpClient = sp.GetRequiredService<HttpClient>();
         var localStorage = sp.GetRequiredService<ILocalStorageService>();
         var baseUrl = httpClient.BaseAddress?.ToString() ?? throw new InvalidOperationException("Base URL not configured");
+        var isHttps = baseUrl.StartsWith("https://", StringComparison.OrdinalIgnoreCase);
 
         var credentials = CallCredentials.FromInterceptor(async (context, metadata) =>
         {
@@ -177,10 +180,14 @@ public static class ConfigureServices
             }
         });
 
+        var channelCredentials = isHttps
+            ? ChannelCredentials.Create(new SslCredentials(), credentials)
+            : ChannelCredentials.Create(ChannelCredentials.Insecure, credentials);
+
         var channel = GrpcChannel.ForAddress(baseUrl, new GrpcChannelOptions
         {
-            UnsafeUseInsecureChannelCallCredentials = true,
-            Credentials = ChannelCredentials.Create(new SslCredentials(), credentials),
+            UnsafeUseInsecureChannelCallCredentials = !isHttps,
+            Credentials = channelCredentials,
             HttpClient = httpClient,
             MaxReceiveMessageSize = 1000 * 1024 * 1024, // 1 GB
             MaxSendMessageSize = 1000 * 1024 * 1024     // 1 GB