feat: add Forward Auth access policies

[RentnerKev]

Summary

Extend RentnerProxy Access Policies with structured Forward Auth support.

This should enable integration with external authentication gateways such
as:

• Authentik
• Authelia
• oauth2-proxy
• other compatible Forward Auth services

without introducing arbitrary Caddy configuration.

Goals

• structured Forward Auth configuration
• upstream URL
• trusted/safe header handling
• configurable auth response headers where required
• clear failure behavior
• integration with existing Access Policies
• compatible with Proxy Hosts
• safe interaction with Basic Auth and IP rules

Security

• validate Forward Auth URLs
• prevent unsafe header forwarding
• no credential leakage
• no open redirect behavior introduced
• no SSRF beyond explicitly configured/admin-controlled auth service
• server-side RBAC remains authoritative

UX

Provide clear Access Policy configuration.

Do not require users to understand Caddy JSON.

Acceptance Criteria

• Authentik-compatible flow works
• Authelia-compatible flow works where protocol semantics match
• successful auth forwards request
• failed auth blocks request correctly
• headers are handled safely
• real Caddy runtime tests exist
• production smokes remain green

Priority

P0 / major Beta feature

Dependencies and sequencing

Builds on completed Access Policies #28, Basic Auth #30 and IP rules #31. Final implementation and header/failure semantics must be included in #72. Required planned feature for #75 unless explicitly deferred.

Alpha 4 prerequisite

Consume the Alpha 4 trusted original-scheme foundation in #79. Forward Auth protocols, policy behavior, and header security remain Beta work.