fix: update gRPC service configuration to use CmsServerBaseUrl resolver

- Replace direct access to configuration for GwUrl with CmsServerBaseUrl.Resolve in AddGrpcServices and TokenNotificationService.
- Ensure proper error handling for missing GwUrl and add support for optional bypass of public TLS using CmsInternalBaseUrl.
- Adjust channel credentials based on whether the base URL is HTTPS or not.

src/FrontOffice.Main/Utilities/CmsServerBaseUrl.cs

@@ -0,0 +1,18 @@
+using Microsoft.Extensions.Configuration;
+
+namespace FrontOffice.Main.Utilities;
+
+/// <summary>
+/// Server-side base URL for CMS (gRPC-Web, SignalR). Prefer in-cluster HTTP when FrontOffice runs on Kubernetes
+/// next to CMS to avoid public ingress TLS chain issues (e.g. PartialChain).
+/// </summary>
+public static class CmsServerBaseUrl
+{
+    public static string? Resolve(IConfiguration configuration)
+    {
+        var internalUrl = configuration["CmsInternalBaseUrl"];
+        if (!string.IsNullOrWhiteSpace(internalUrl))
+            return internalUrl.TrimEnd('/');
+        return configuration["GwUrl"]?.TrimEnd('/');
+    }
+}

src/FrontOffice.Main/Utilities/TokenNotificationService.cs

@@ -69,7 +69,7 @@ public class TokenNotificationService : IAsyncDisposable
                 return;
             }
 
-            var gwUrl = _configuration["GwUrl"]?.TrimEnd('/') ?? "https://localhost:5002";
+            var gwUrl = CmsServerBaseUrl.Resolve(_configuration) ?? "https://localhost:5002";
             var hubPath = _configuration["SignalR:HubPath"] ?? "/hubs/token-relay";
             var hubUrl = $"{gwUrl}{hubPath}";