fix: trust Coolify/Traefik reverse proxy headers

Without trustProxies(), Laravel didn't know requests arriving via
Traefik were originally HTTPS, so route()/url() generated http://
links (stream/proxy, vtt-proxy, etc.), which browsers block as mixed
content on the HTTPS page. Also corrected APP_URL in Coolify's env
vars from http://localhost/ to https://animexe.com.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

bootstrap/app.php

@@ -3,6 +3,7 @@
 use Illuminate\Foundation\Application;
 use Illuminate\Foundation\Configuration\Exceptions;
 use Illuminate\Foundation\Configuration\Middleware;
+use Illuminate\Http\Request;
 
 return Application::configure(basePath: dirname(__DIR__))
     ->withRouting(
@@ -12,6 +13,16 @@ return Application::configure(basePath: dirname(__DIR__))
         health: '/up',
     )
     ->withMiddleware(function (Middleware $middleware): void {
+        // Coolify/Traefik SSL'i kendi katmanında sonlandırıyor; X-Forwarded-* header'larına
+        // güvenmezsek route()/url() hep http:// üretir (mixed content hatalarına yol açar).
+        $middleware->trustProxies(
+            at: '*',
+            headers: Request::HEADER_X_FORWARDED_FOR
+                | Request::HEADER_X_FORWARDED_HOST
+                | Request::HEADER_X_FORWARDED_PORT
+                | Request::HEADER_X_FORWARDED_PROTO
+                | Request::HEADER_X_FORWARDED_AWS_ELB,
+        );
         $middleware->alias([
             'admin'         => \App\Http\Middleware\AdminMiddleware::class,
             'admin.access'  => \App\Http\Middleware\AdminAccessMiddleware::class,