P7 r8 fix: forward_auth trust boundary (XFF/XFH honored only from trusted proxy; direct/spoofed requests use socket identity) + adversarial tests

dashcaddy-api/src/app.js

@@ -853,6 +853,8 @@ async function createApp() {
       p7ForwardAuthRouter = networkForwardAuthRoutes({
         service,
         asyncHandler: ctx.asyncHandler,
+        trustedProxies: (config.FORWARD_AUTH_TRUSTED_PROXIES || '127.0.0.1,::1')
+          .split(',').map((s) => s.trim()).filter(Boolean),
         log: ctx.log,
       });
     }