The old ReplicaSet 789f79897c left a Pending pod (home-assistant-789f79897c-plf7n)
because the nucbox node is at 95.9% memory. Adding restartedAt annotation to
trigger a fresh rollout so the new ReplicaSet takes over.
HA runs with hostNetwork on roger-nucbox-evo-x2 while Traefik runs on the
raspberrypi node, so requests arrive at HA from 10.88.20.11. The previous
trusted_proxies entry (10.88.88.0/24) did not include this address, causing
HA to reject X-Forwarded-For and return 400 on every ingress request.
