feat(ap4): defend forwarded identity headers

scripts/verify-pattern4.sh

@@ -18,9 +18,24 @@ docker compose exec -T nginx nginx -V 2>&1 |
 docker compose exec -T nginx nginx -T 2>&1 |
   grep -q 'proxy_pass_request_body off'
 
+app_container_id="$(docker compose ps -q app)"
+published_app_port="$(docker inspect "$app_container_id" \
+  --format '{{with (index .NetworkSettings.Ports "8081/tcp")}}{{json .}}{{end}}')"
+if [ -n "$published_app_port" ]; then
+  echo "backend port 8081 must not be published on the host" >&2
+  exit 1
+fi
+
+if docker compose exec -T nginx wget -q -O /dev/null \
+  --header 'X-Auth-Request-User: spoofed-admin' \
+  http://app:8081/edge/me 2>/dev/null; then
+  echo "backend accepted a forged identity without the internal token" >&2
+  exit 1
+fi
+
 npm --prefix e2e ci
 E2E_USERNAME=regular-user \
 E2E_PASSWORD="$REGULAR_USER_PASSWORD" \
   npm --prefix e2e run test:pattern4
 
-echo "AP4 Nginx auth_request edge flow verified"
+echo "AP4 hardened Nginx auth_request edge flow verified"