Implement reverse-proxy forward-auth

Add a /forward-auth endpoint that validates the existing Porchlight
session for reverse proxies and returns identity headers for
authenticated active users. Unauthenticated or inactive sessions
redirect to login, with optional post-login return targets reconstructed
from proxy headers and constrained by an allowed host list.

Also add forward_auth_allowed_redirect_hosts configuration, preserve
validated forward-auth return targets through login/session reset,
exempt the endpoint from CSRF for proxy subrequests, document
configuration, and cover the flow with tests.

tests/test_config.py

@@ -15,6 +15,7 @@ def test_default_settings() -> None:
     assert settings.sqlite_path == "data/oidc_op.db"
     assert settings.manage_client_id == "manage-app"
     assert settings.invite_ttl == 86400
+    assert settings.forward_auth_allowed_redirect_hosts == []
     assert settings.theme == "default"
 
 
@@ -49,6 +50,7 @@ def test_settings_from_toml_file(tmp_path: Path) -> None:
 issuer = "https://toml.example.com"
 debug = true
 sqlite_path = "custom/path.db"
+forward_auth_allowed_redirect_hosts = ["app.example.com", "*.apps.example.com"]
 
 [clients.my-app]
 client_secret = "secret123"
@@ -62,6 +64,7 @@ scope = ["openid", "profile"]
     assert settings.issuer == "https://toml.example.com"
     assert settings.debug is True
     assert settings.sqlite_path == "custom/path.db"
+    assert settings.forward_auth_allowed_redirect_hosts == ["app.example.com", "*.apps.example.com"]
     assert "my-app" in settings.clients
     assert settings.clients["my-app"].client_secret == "secret123"
     assert settings.clients["my-app"].redirect_uris == ["https://app.example.com/callback"]