Read X-Forwarded-Host (and HTTP_X_FORWARDED_HOST) so tunnel requests resolve

the correct store behind a proxy.
TunnelStoreProvisioner now receives ResourceConnection and copies default web
CMS pages/blocks and theme-related setup for new tunnel stores.
Tighten system.xml (remove invalid default), crontab/config defaults, and
update tests with a ResourceConnection stub for PHPUnit.

Magesail/Test/Stubs/Magento/Framework/App/ResourceConnection.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Magento\Framework\App;
+
+/**
+ * Minimal stub so PHPUnit can mock {@see \Magento\Framework\App\ResourceConnection} in unit tests.
+ */
+class ResourceConnection
+{
+    public function getConnection(?string $resourceName = null): mixed
+    {
+        return null;
+    }
+
+    public function getTableName(string $table): string
+    {
+        return $table;
+    }
+}