Runtime settings with env-wins pinning + Cloudflare Zero Trust proxy provider

[swimmesberger]

Moves the env-var-only configuration behind runtime settings with an honest precedence story, and adds a Cloudflare Zero Trust reverse-proxy provider beside the built-in Caddy engine — tunnel public hostnames, DNS records and Access applications are now projected from the existing routes table instead of clicked together in the dashboard.

What changed

Runtime settings with env-wins layering (ADR-0014)

• Configuration layers reordered to appsettings < boot snapshot < settings store < env vars: stored settings live-reload (no restart), but a WATCHTOWER__* env var pins its setting — env stays infrastructure-as-code, and WATCHTOWER__AUTH__ENABLED=false + restart is a guaranteed lockout escape hatch by construction.
• A synchronous boot snapshot reads the stored Global settings straight from SQLite before the host builds. Without it a stored Auth:Enabled could never take effect: the Elarion settings provider only loads in a hosted service, after the pre-DI pipeline reads in Program.cs.
• EnvironmentSettingPins: every settings get-handler reports its env-pinned paths (the UI disables those fields per-field, naming the variable); update handlers reject changes to pinned values and never write pinned keys.
• New settings surfaces: Authentication (restart-required contract around Auth:Enabled, plus a lockout guard — enabling requires an existing enabled admin) and Reverse proxy (fully runtime-switchable; CaddyManager reacts to options changes — enable reconciles, disable stops/removes the container keeping certificates).
• Behavior change: a deployment that set an env var and later edited the same setting in the UI previously ran the UI value; it now runs the env value (shown as pinned).

Pluggable proxy provider (ADR-0015)

• IProxyProvider + ProxyProviderRouter (per-call off Proxy:Provider, same pattern as the metrics backend); the per-stack ingress-network topology is shared via ProxyIngressNetworks. Switching provider is one settings save: the old data plane tears down while the new one reconciles, no restart.
• Cloudflare Tunnel provider: finds/creates the remotely-managed tunnel by name, replaces its ingress rules with a projection of the route table (terminal http_status:404 catch-all), and upserts one proxied CNAME per route domain. cloudflared runs as a Watchtower-managed container by default; unmanaged mode leaves an operator-run cloudflared alone and only manages remote config + DNS (optionally connecting a named container to the ingress networks). Credentials are validated against the Cloudflare API before persisting.

Zero Trust Access applications (phase 3)

• Protected routes get a self_hosted Access app (watchtower: {domain}) with a Watchtower-owned allow policy. Authenticated admits the configured allow sources — emails, email domains, Access group ids (the existing-group-of-Entra-users workflow) and/or reusable policy ids (attached on the app). Restricted admits exactly the route's grant-derived emails and is never widened by instance-wide sources.
• Safety rails: an empty allow-list skips with a warning instead of publishing a deny-all app; only apps carrying the watchtower: name prefix are ever deleted.

Edge portability for apps

• New IdentityHeaderMode.Cloudflare (integrated auth): forwards Cf-Access-Authenticated-User-Email and duplicates the Watchtower assertion under Cf-Access-Jwt-Assertion, so an app written against Cloudflare's header contract runs unchanged behind either edge. Both names joined the anti-spoofing strip set (invariant test-pinned).
• Deploys now inject WATCHTOWER_AUTH_JWKS_URL resolved from the active edge (Cloudflare team certs URL via the new Proxy:Cloudflare:TeamDomain setting, or Watchtower's /api/auth/jwks under integrated auth) — an app that reads it instead of hard-coding an issuer swaps edges with zero app configuration; the next deploy re-injects the right URL.

Review notes

• The boot snapshot reads elarion_settings with a raw read-only SQLite connection before migrations run — tolerant of a missing file/table by design (first run).
• proxy.getStatus gained a provider field; caddyRunning keeps its wire name but reports the active provider's data plane.
• Single-zone assumption for DNS upserts (documented); per-domain failures are best-effort logged.
• Docs: ADR-0014, ADR-0015, docs/reverse-proxy/cloudflare.md, central-auth README (new forwarding mode), docs/public-app-api.md (new injected variable), README config section.
• 699 backend tests green (new: layering precedence, pin detection/rejection, auth-enable guard, provider transitions incl. switch, ingress + Access projections, Cf header mode, JWKS resolution/injection).