feat(auth): trusted header authentication with profile binding (closes #3351)

[Frankstar]

Summary

This PR implements trusted header authentication for reverse-proxy deployments (Authelia, Authentik, nginx auth_request, etc.), resolving #3351.

When a reverse proxy handles authentication, the WebUI can trust headers sent by that proxy to identify the user and optionally bind them to a specific Hermes profile. This enables multi-user access with profile isolation without implementing a separate login system.

New Environment Variables

Variable	Description	Example
HERMES_WEBUI_TRUSTED_AUTH_HEADER	Header containing the authenticated username	Remote-User
HERMES_WEBUI_TRUSTED_GROUPS_HEADER	Header containing comma-separated group names	Remote-Groups
HERMES_WEBUI_GROUP_PROFILE_MAP	Maps proxy groups to Hermes profiles	hermes_devops=devops,hermes_coworkers=coworkers
HERMES_WEBUI_TRUSTED_AUTH_PROXY_IPS	Required. CIDR allowlist of trusted proxy IPs	127.0.0.1,::1,10.0.0.0/8
HERMES_WEBUI_TRUSTED_AUTH_LOGOUT_URL	Optional SSO logout URL (e.g. Authelia)	https://auth.example.com/logout

Security Design

• Proxy IP allowlist is mandatory — without HERMES_WEBUI_TRUSTED_AUTH_PROXY_IPS, the feature is disabled
• Untrusted headers are stripped — any Remote-User/Remote-Groups headers from non-allowlisted IPs are deleted before auth decisions
• Session auto-creation — valid trusted requests get a session cookie automatically; no separate login screen
• Profile binding — users are locked to their mapped profile via the hermes_profile cookie

Authelia Example

# nginx reverse proxy
proxy_set_header Remote-User $user;
proxy_set_header Remote-Groups $groups;

========
# Authelia access control
access_control:
  rules:
    - domain: ai.example.com
      policy: two_factor
      subject: ["group:hermes_devops", "group:hermes_coworkers"]

========
# Hermes WebUI environment
HERMES_WEBUI_TRUSTED_AUTH_HEADER=***
HERMES_WEBUI_TRUSTED_GROUPS_HEADER=Remote-Groups
HERMES_WEBUI_GROUP_PROFILE_MAP=hermes_devops=devops,hermes_coworkers=coworkers
HERMES_WEBUI_TRUSTED_AUTH_PROXY_IPS=***
HERMES_WEBUI_TRUSTED_AUTH_LOGOUT_URL=***