Fix asset URLs generated as http:// behind staging's reverse proxy

Staging terminates SSL at a reverse proxy in front of the app, but
Laravel had no trustProxies() configured, so it never saw the request
as HTTPS and generated http:// asset URLs on the https:// page.
Browsers block that as mixed content, which silently broke every
JS-enhanced Filament field (FileUpload, Textarea, etc.) — e.g. the
Ev Company logo field falling back to a bare native file input.

- bootstrap/app.php: trust the proxy via X-Forwarded-* headers.
- AppServiceProvider: force the https scheme when APP_URL is https,
  as a fallback in case the forwarded header is ever missing.

app/Providers/AppServiceProvider.php

@@ -5,6 +5,7 @@ namespace App\Providers;
 use Illuminate\Cache\RateLimiting\Limit;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\RateLimiter;
+use Illuminate\Support\Facades\URL;
 use Illuminate\Support\ServiceProvider;
 
 class AppServiceProvider extends ServiceProvider
@@ -23,6 +24,16 @@ class AppServiceProvider extends ServiceProvider
     public function boot(): void
     {
         $this->configureRateLimiting();
+
+        // Belt-and-suspenders alongside bootstrap/app.php's trustProxies():
+        // that already makes url()/asset() respect the proxy's
+        // X-Forwarded-Proto, but if that header is ever missing or a proxy
+        // is misconfigured, this still forces https:// asset/route URLs on
+        // any environment whose APP_URL is itself https — so a plain-http
+        // request never causes a mixed-content-blocked asset again.
+        if (str(config('app.url'))->startsWith('https://')) {
+            URL::forceScheme('https');
+        }
     }
 
     /**