Per-host SSO: OpenResty gate + auth location (#57)

- hostfeatures.lua: replace basic-auth-only enforcement with a combined
  apply_auth() that allows if EITHER basic auth OR a valid SSO session passes.
  A "Basic" Authorization header takes the basic path (401 on failure);
  otherwise a browser is 302'd to /__proxy_auth/start. SSO sessions are read
  straight from Redis (proxy_SsoSession_<sid>, sid from the __proxy_sso cookie,
  character-restricted) and matched to the host.
- proxy.conf: add a /__proxy_auth/ location (outside the gate) that forwards to
  the nodejs app so the OIDC flow can run and set the cookie on every host.
- nginx.conf: add the proxy_auth_backend upstream (defaults to 127.0.0.1:3000).

Needs live verification on an OpenResty box (no Lua/nginx runtime in CI here).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

ops/nginx_conf/nginx.conf

@@ -30,6 +30,13 @@ http {
 
 	resolver 8.8.4.4 8.8.8.8;
 
+	# Backend for per-host SSO endpoints (/__proxy_auth, see proxy.conf). Point
+	# this at the nodejs app that serves the admin UI. Default assumes it is
+	# colocated on this box; change the address for a split deployment.
+	upstream proxy_auth_backend {
+		server 127.0.0.1:3000;
+	}
+
 	init_by_lua_block {
 
 		auto_ssl = (require "resty.auto-ssl").new()