DC-154: forward_auth enforcement endpoint (whois + access map + sensitive step-up) + tests

dashcaddy-api/src/utilities/middleware.js

@@ -397,6 +397,12 @@ module.exports = function configureMiddleware(app, {
     { path: '/api/v1/totp/verify-setup',  exact: true,  method: 'POST' },
     { path: '/api/v1/totp/check-session', exact: true },
     { path: '/api/v1/auth/gate/',        prefix: true },
+    // DC-154: network forward_auth target — called by Caddy on EVERY
+    // protected request, stateless, no cookie/CSRF token to present.
+    // The route itself is the auth decision; mounting it behind the TOTP
+    // gate would deadlock every protected site. Prefix (trailing slash)
+    // covers GET + POST on the canonical /network/forward-auth/ URI.
+    { path: '/api/v1/network/forward-auth/', prefix: true },
     { path: '/api/v1/auth/app-token/',   prefix: true },
     { path: '/api/v1/auth/login-page',   exact: true,  method: 'GET' },
     // Must be public: a fresh cross-subdomain visitor has no session yet by