Implements docs/admin-forward-auth.md. Off by default, switchable from
Settings -> Single sign-on, from config.json, or from the container's env
(CODERAI_ADMIN_FORWARD_AUTH=1|0, CODERAI_ADMIN_FORWARD_AUTH_SECRET) — the
env switch can disable it as well as enable it, so a unit file can override
a mounted config either way.

A request is forward-authed only when BOTH checks pass: the immediate peer
is in trusted_proxies AND the shared secret header matches (constant time).
Either alone is forgeable, so the identity header is not even read until
trust is established — a client sending X-Forwarded-User directly is
ignored. Enabled with no secret stays OFF with a log line, because without
one there is nothing separating the proxy from any other client.

It mints a real signed session and injects it into the current request, not
just a rendered page: the dashboard's own /admin/api/* calls authenticate
by cookie, so a page with 401ing AJAX would not be a working GUI. An
auto-created account gets a random password nobody is told and is never
asked to change it. keep_local_login=false makes /login refuse. Logout
honours post_logout_url, since returning to our own login would be met by
the proxy's headers and log the user straight back in.

GUI only: /v1/* keeps its bearer tokens whatever the proxy asserts, and the
readiness probes stay credential-free. The settings API reports
shared_secret_set as a boolean and never the secret.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>