fix(config): harden registry forward auth headers

[Agent-Hellboy]

Summary

• disable trusted forwarded headers for the registry Traefik forward-auth middleware
• add a manifest regression test for both base and HTTP overlay dynamic configs

Root cause

The registry authz endpoint scopes non-admin access from forwarded URI headers, while Traefik was configured to trust client-supplied forwarded headers for the registry forward-auth middleware. A client could spoof an allowed forwarded path while requesting a different registry backend path.

Validation

• go test ./test/manifest -count=1
• (cd services/api && go test ./... -count=1)
• git diff --check
• pre-commit hooks during commit: gitleaks, go fmt, staticcheck, go vet, generated file drift

[gemini-code-assist]

Code Review

This pull request disables trustForwardHeader for the registry-admin-auth middleware in the Traefik dynamic configuration and adds a regression test to verify this setting. Feedback was provided to improve the test's robustness by replacing an early return with a conditional check, ensuring that future assertions in the test loop are not inadvertently skipped.