feat(identity): inject X-Forwarded-User headers after JWT validation (#15)
Closes homelab#9 (P3.4)
## Changes
- New `internal/identity` package: header injection + anti-spoofing
- `proxy.go`: strip spoofed headers on all requests, inject identity after JWT validation
## Headers
| Header | Source | When |
|--------|--------|------|
| X-Forwarded-User | sub claim | Always after JWT |
| X-Forwarded-Roles | roles or permissions claim | Always after JWT |
| X-Acting-Service | azp claim | Only when azp != sub |
| X-Auth-Verified | literal "true" | Always after JWT |
## Tests
13 tests, 93.9% coverage. Covers: spoofing, service accounts, human users, empty claims, nil values, wildcard, mixed types, precedence.
---------
Co-authored-by: Poimen <[email protected]>
Reviewed-on: #15
rockandpoimen
97707aa2f2