feat(k8s): make the OTLP trace endpoint a chart value (refs #186)

otelEndpoint defaults to the chart's own tempo; deploy overrides it from the
OTEL_ENDPOINT repo variable, so the labs cluster can ship traces to the
monitoring stack's Tempo instead of failing every export.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

infra/helm/big-reference/values.yaml

@@ -30,6 +30,12 @@ host: 192.168.122.100
 # portals' authority (runbook, "Publishing through the labs Caddy").
 keycloakUrl: ""
 
+# Where the .NET services send traces (OTLP gRPC). The default is the chart's own
+# `tempo` workload (off by default, like compose). Point it at a Tempo outside the
+# release, e.g. the cluster monitoring stack's http://tempo.monitoring.svc:4317 —
+# with no Tempo at all, every export fails and is counted as a .NET exception.
+otelEndpoint: http://tempo:4317
+
 demo:
   # Fill in and submit the medewerker OTP step from the fixture secret, so a public
   # demo shows MFA enforced without an authenticator: makes the big-demo theme
@@ -160,10 +166,11 @@ envGroups:
     NOTIFICATIONS_DISABLED: "false"
     RUN_SETUP_CONFIG: "true"
 
-  # Traces for the .NET services. Always set, like compose: the exporter fails
-  # harmlessly when Tempo is absent (services/*/Program.cs).
+  # Traces for the .NET services. Always set, like compose. With no Tempo behind
+  # `otelEndpoint` the exporter fails quietly but throws on every batch, which
+  # shows up as HttpRequestException/SocketException in dotnet_exceptions_total.
   otel:
-    OTEL_EXPORTER_OTLP_ENDPOINT: http://tempo:4317
+    OTEL_EXPORTER_OTLP_ENDPOINT: '{{ .Values.otelEndpoint }}'
     OTEL_EXPORTER_OTLP_PROTOCOL: grpc
 
 # ── Workloads ──────────────────────────────────────────────────────────────────