feat: add validated Traefik ForwardAuth alternative

scripts/verify-traefik-forwardauth-config.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env sh
+set -eu
+
+config_dir="$PWD/deploy/traefik"
+output_file="$(mktemp)"
+cleanup() {
+  rm -f "$output_file"
+}
+trap cleanup EXIT
+
+status=0
+timeout 4 docker run --rm \
+  -v "$config_dir:/etc/traefik:ro" \
+  traefik:v3.5.3 \
+  --configFile=/etc/traefik/traefik.yml >"$output_file" 2>&1 || status=$?
+
+if [ "$status" -ne 0 ] && [ "$status" -ne 124 ]; then
+  cat "$output_file" >&2
+  exit "$status"
+fi
+if rg -qi 'error|failed' "$output_file"; then
+  cat "$output_file" >&2
+  exit 1
+fi
+
+grep -q 'trustForwardHeader: false' deploy/traefik/dynamic.yml
+grep -q 'X-Auth-Request-User' deploy/traefik/dynamic.yml
+echo "Traefik file provider and ForwardAuth configuration verified"