fix(login): apply custom request headers from environment variable in proxy (#12144)

Closes #12125

# Which Problems Are Solved

The proxy middleware (proxy.ts) did not apply `CUSTOM_REQUEST_HEADERS`
to rewritten requests (/.well-known/*, /oauth/*, /oidc/*, etc.). When
`ZITADEL_API_URL` points to an internal service name, the Host header on
proxied requests remained the internal name instead of the configured
public domain, causing Errors.Instance.NotFound.

# How the Problems Are Solved

The other two outgoing request paths — the connectRPC transport and the
security-settings fetch — already applied these headers. This adds the
same applyCustomHeaders() call to the proxy path.

Co-authored-by: Ramon <mail@conblem.me>

apps/login/src/proxy.ts

@@ -1,5 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
 import { buildCSP } from "./lib/csp";
+import { applyCustomHeaders } from "./lib/custom-headers";
 import { createLogger } from "./lib/logger";
 import { getIframeOrigins } from "./lib/server/security-settings";
 import { getServiceConfig } from "./lib/service-url";
@@ -77,6 +78,12 @@ export async function proxy(request: NextRequest) {
     requestHeaders.set("x-zitadel-instance-host", instanceHost);
   }
 
+  // Apply headers from CUSTOM_REQUEST_HEADERS environment variable
+  applyCustomHeaders({
+    set: (key, value) => requestHeaders.set(key, value),
+    remove: (key) => requestHeaders.delete(key),
+  });
+
   responseHeaders.set("Access-Control-Allow-Origin", "*");
   responseHeaders.set("Access-Control-Allow-Headers", "*");