docs: collect evidence for the two-hop header contract failure

Control experiment isolates two independent causes: the nginx 443 block still emits X-Forwarded-Proto http, and Traefik rewrites forwarded headers regardless.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/evidence/two-hop-proxy-headers/01-environment.txt

@@ -0,0 +1,34 @@
+수집 시각: 2026-09-03 15:01:30 KST
+대상: https://app1.hyeonworks.com/api/echo
+
+=== [1] 호스트 nginx 가 주입하는 헤더 ===
+3:	server 192.168.122.11:80;
+4:	server 192.168.122.12:80;
+8:	listen 80 default_server;
+14:	listen 443 ssl default_server;
+26:		proxy_set_header Host			$host;
+27:		proxy_set_header X-Forwarded-Host	$host;
+28:		proxy_set_header X-Forwarded-Proto	http;
+29:		proxy_set_header X-Forwarded-Port	80;
+30:		proxy_set_header X-Forwarded-For	$remote_addr;
+31:		proxy_set_header X-Real-IP		$remote_addr;
+
+=== [2] Traefik entryPoint 인자 (forwardedHeaders 부재 확인) ===
+["--entryPoints.metrics.address=:9100/tcp"
+"--entryPoints.traefik.address=:8080/tcp"
+"--entryPoints.web.address=:8000/tcp"
+"--entryPoints.websecure.address=:8443/tcp"
+"--metrics.prometheus.entrypoint=metrics"
+"--entryPoints.websecure.http.tls=true"
+  → forwardedHeaders.trustedIPs 인자가 없음 = 기본값(신뢰 안 함)
+
+=== [3] Traefik 파드 수와 위치 ===
+traefik-59b7647586-ftwf8   10.42.0.8   kc-lab-1
+
+=== [4] traefik Service externalTrafficPolicy ===
+Cluster
+  → Cluster = svclb 가 SNAT 하여 클라이언트 IP 소실
+
+=== [5] 앱 파드의 스위치 상태 ===
+SERVER_PORT=8081
+SERVER_FORWARD_HEADERS_STRATEGY=none