fix: surface install progress behind reverse proxies

tests/release-scripts.test.sh

@@ -692,6 +692,23 @@ test_installer_runs_when_piped_to_bash() (
   [[ "$output" != *'BASH_SOURCE'* ]]
 )
 
+test_installer_shows_live_health_progress() (
+  local page="$PROJECT_ROOT/oa-backend/src/installer/resources/static/index.html"
+  grep -Fq 'role="progressbar"' "$page"
+  grep -Fq 'id="install-log"' "$page"
+  grep -Fq 'Math.min(95, estimated)' "$page"
+  grep -Fq '健康检查第 ${attempt} 次' "$page"
+  grep -Fq '本页已等待 ${formatElapsed' "$page"
+  grep -Fq 'installLocked' "$page"
+)
+
+test_app_honors_reverse_proxy_headers() (
+  grep -Fqx '  forward-headers-strategy: framework' \
+    "$PROJECT_ROOT/oa-backend/src/main/resources/application.yml"
+  grep -Fqx '  forward-headers-strategy: framework' \
+    "$PROJECT_ROOT/oa-backend/src/installer/resources/application.yml"
+)
+
 run_test 'erp-run preserves Java option arguments' test_erp_run_preserves_java_option_arguments
 run_test 'erp-run finalizes a healthy pending installation' test_erp_run_finalizes_healthy_pending_install
 run_test 'erp-run preserves a failed pending installation' test_erp_run_preserves_failed_pending_install
@@ -713,6 +730,8 @@ run_test 'uninstaller aborts while the service remains active' test_uninstaller_
 run_test 'no-service install disables online update' test_no_service_install_disables_online_update
 run_test 'release workflow uses the scoped Gitea job token' test_release_workflow_uses_scoped_job_token
 run_test 'installer starts correctly when piped to bash' test_installer_runs_when_piped_to_bash
+run_test 'installer shows live formal-service health progress' test_installer_shows_live_health_progress
+run_test 'application honors standard reverse-proxy headers' test_app_honors_reverse_proxy_headers
 
 printf 'RESULT pass=%s fail=%s\n' "$PASS" "$FAIL"
 [[ "$FAIL" -eq 0 ]]