Per-host SSO: OpenResty gate + auth location (#57)

- hostfeatures.lua: replace basic-auth-only enforcement with a combined
  apply_auth() that allows if EITHER basic auth OR a valid SSO session passes.
  A "Basic" Authorization header takes the basic path (401 on failure);
  otherwise a browser is 302'd to /__proxy_auth/start. SSO sessions are read
  straight from Redis (proxy_SsoSession_<sid>, sid from the __proxy_sso cookie,
  character-restricted) and matched to the host.
- proxy.conf: add a /__proxy_auth/ location (outside the gate) that forwards to
  the nodejs app so the OIDC flow can run and set the cookie on every host.
- nginx.conf: add the proxy_auth_backend upstream (defaults to 127.0.0.1:3000).

Needs live verification on an OpenResty box (no Lua/nginx runtime in CI here).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

ops/nginx_conf/proxy.conf

@@ -12,6 +12,19 @@ server {
   real_ip_header X-Real-IP;
   real_ip_recursive on;
 
+  # Per-host SSO endpoints (#57), served on EVERY proxied host by the nodejs app.
+  # This location deliberately sits OUTSIDE the auth gate in `location /` (so the
+  # login flow itself is never gated) and forwards to the app, which runs the
+  # OIDC flow and sets the __proxy_sso session cookie for this host.
+  location /__proxy_auth/ {
+	proxy_pass http://proxy_auth_backend;
+	proxy_http_version 1.1;
+	proxy_set_header Host $host;
+	proxy_set_header X-Real-IP $remote_addr;
+	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+	proxy_set_header X-Forwarded-Proto $scheme;
+  }
+
   location / {
 
 	set $target '';