docs(k8s): document auto-TLS OTLP behavior + P0-2 historical note

Companion to api / worker / provisioner commits that fix OTel
distributed tracing in prod (BUGHUNT-2026-05-20-T21 P0-2). The
tracer.go fix is code-only — the configmap key behaviour is
unchanged — but the comment on OTEL_EXPORTER_OTLP_ENDPOINT used
to claim only `host:port` (no scheme) was accepted. The new
helper accepts either form, strips the scheme, and uses it to
auto-select TLS vs plaintext. Document the new contract here
and pin a brief reference to the bug so the next reader who
edits this finds the rationale.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: mastermanas805

k8s/configmap.yaml

@@ -5,7 +5,21 @@ metadata:
   namespace: instant
 data:
   PORT: "8080"
-  # OpenTelemetry OTLP gRPC (host:port, no scheme). Empty = tracing disabled (noop).
+  # OpenTelemetry OTLP gRPC endpoint. Accepts either a bare `host:port` or
+  # a full `https://host:port` / `http://host:port` URL — the InitTracer
+  # helper strips the scheme and uses it to auto-select TLS vs plaintext.
+  # Empty = tracing disabled (noop). In prod each Deployment overrides this
+  # via its own `env:` entry to "https://otlp.nr-data.net:4317" (US) or
+  # "https://otlp.eu01.nr-data.net:4317" (EU). NR ingest also requires
+  # NEW_RELIC_LICENSE_KEY to be set in instant-secrets / instant-infra-
+  # secrets; without it InitTracer logs telemetry.nr_license_missing WARN
+  # and exports will be rejected by NR.
+  #
+  # 2026-05-20 P0-2: prior tracer.go used WithInsecure() against the TLS
+  # endpoint with no api-key header — every export failed silently and
+  # trace_id was empty on every log line. The TLS-by-scheme + api-key
+  # header pair in tracer.go is the fix; the configmap behaviour did NOT
+  # change.
   OTEL_EXPORTER_OTLP_ENDPOINT: ""
   OTEL_SERVICE_NAME: "instant-api"
   ENVIRONMENT: development