fix(agent): stop light-action 401s for unconfigured proxy datasources

[mayankpande88]

Problem

Loki showed ~all light-action failures over the last 3 days were jaeger:
jaeger_query_traces (368) and jaeger_query_services (190), rejected with:

auth: action "jaeger_query_traces" not in light-action allowlist

Root cause is a class of bug, not just jaeger. The agent only registers a
datasource's actions — both the handler and the light-action allowlist
entry — when that datasource's URL is set at startup (main.go). But the
backend decides what to dispatch from each account's integration config
(e.g. traces=jaeger-via-agent), independent of the agent's env. So any
datasource the backend can select but the chart doesn't wire gets a 401.

The nudgebee-agent chart wires no jaeger URL at all, yet accounts configured
for jaeger-via-agent still dispatch jaeger_query_* → every one rejected.

Same latent risk for chronosphere, pinot, gke — they just aren't in use yet.

Fix (whole class, not just jaeger)

• registerProxy() always adds a read-only proxy datasource's action names
  to the allowlist (sourced from the package's own Handlers() map, so names
  can't drift). URL set → real handler; URL unset → a stub returning a clear
  "<datasource> not configured" error instead of an auth rejection. Applied to
  jaeger, chronosphere, pinot, signoz, elasticsearch, gcp, http-proxy. Mirrors
  the existing query_data / api_traces_enricher_v2 unconditional-register
  precedent. Prometheus/Loki left as-is (wired by default + auto-discovered).
• config: JAEGER_URL falls back to JAEGER_QUERY_URL, aligning handler
  registration with the var the telemetry heartbeat already reports.
• chart: first-class values for the optional trace datasources
  (runner.jaeger.queryUrl, runner.chronosphere.{url,apiKey},
  runner.pinot.{url,authToken,username,password}), surfaced as env in the
  runner ConfigMap. This is what makes jaeger actually return traces — the
  stub only stops the auth failure.

Behavior change

Dispatcher path for a dispatched-but-unconfigured datasource action goes from
401 "not in light-action allowlist" (auth reject) to 200 when
configured, or 500 with an actionable "not configured" message when not.

To resolve the affected tenant

Set runner.jaeger.queryUrl to the in-cluster jaeger-query endpoint and
restart the pod. Without it, jaeger goes 401 → "not configured" 500 — better,
but no traces until the URL is provided.

Validation

• gofmt / go vet clean, go build ./... OK, agent test suites pass.
• helm lint passes; helm template renders the new env when set and omits it by default.

[github-actions]

📦 Image Tags Updated

I've automatically updated the image tags in `charts/nudgebee-agent/values.yaml` to the latest versions from GHCR for the `main` branch.

The image tags are now synchronized with the latest builds and ready for release.

[gemini-code-assist]

Code Review

This pull request introduces a registerProxy helper function in the agent to register read-only proxy datasources unconditionally, returning a clear 'not configured' error when disabled instead of failing authorization. It also updates the Helm chart and agent configuration to support Jaeger, Chronosphere, and Pinot. The feedback suggests using the | quote filter for the newly added environment variables in the Helm template to prevent potential YAML parsing errors or unexpected type coercion.

[github-actions]

📦 Image Tags Updated

I've automatically updated the image tags in `charts/nudgebee-agent/values.yaml` to the latest versions from GHCR for the `main` branch.

The image tags are now synchronized with the latest builds and ready for release.