#4229 Align Caddy reverse-proxy TLS documentation with Kubernetes proxy guidance

Documentation enhancement request:

The Set Up TLS for swamp serve page has a minimal Caddy reverse-proxy example, while the Kubernetes deployment guide already documents an important requirement: when a proxy re-encrypts traffic to Serve, the upstream connection must use HTTP/1.1 and preserve WebSocket upgrades.

Please bring the Caddy reverse-proxy example and the TLS and Proxies reference into line with that guidance. The example should show:

• preserving the public Host and Origin values used for dashboard OAuth origin validation;
• forwarding X-Swamp-Dashboard-Origin where required by the dashboard session endpoint;
• forcing the re-encrypted upstream transport to HTTP/1.1;
• preserving WebSocket upgrades and long-lived connections;
• configuring --trusted-hosts with the public hostname.

Observed behavior: With Caddy re-encrypting to Serve over HTTP/2, the OAuth dashboard session endpoint returned HTTP 403 and Serve logged "Dashboard session request rejected: missing host". The same request over an HTTP/1.1 upstream returned the normal authentication response. Forcing the Caddy upstream transport to HTTP/1.1 resolved the issue.

Suggested documentation locations:

• How-to: Set Up TLS for swamp serve, under Reverse proxy with Caddy
• Reference: TLS and Proxies
• Cross-link or clarify the existing Kubernetes guidance so Caddy users do not miss it

No private hostnames, IP addresses, credentials, or OAuth client identifiers are included in this report.