Add forward auth portal — CPM as built-in IdP replacing Authentik

CPM can now act as its own forward auth provider for proxied sites.
Users authenticate at a login portal (credentials or OAuth) and Caddy
gates access via a verify subrequest, eliminating the need for external
IdPs like Authentik.

Key components:
- Forward auth flow: verify endpoint, exchange code callback, login portal
- User groups with membership management
- Per-proxy-host access control (users and/or groups)
- Caddy config generation for forward_auth handler + callback route
- OAuth and credential login on the portal page
- Admin UI: groups page, inline user/group assignment in proxy host form
- REST API: /api/v1/groups, /api/v1/forward-auth-sessions, per-host access
- Integration tests for groups and forward auth schema

Also fixes mTLS E2E test selectors broken by the RBAC refactor.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

app/api/v1/proxy-hosts/[id]/forward-auth-access/route.ts

@@ -0,0 +1,35 @@
+import { NextRequest, NextResponse } from "next/server";
+import { requireApiAdmin, apiErrorResponse } from "@/src/lib/api-auth";
+import {
+  getForwardAuthAccessForHost,
+  setForwardAuthAccess
+} from "@/src/lib/models/forward-auth";
+
+type Params = { params: Promise<{ id: string }> };
+
+export async function GET(request: NextRequest, { params }: Params) {
+  try {
+    await requireApiAdmin(request);
+    const { id } = await params;
+    const access = await getForwardAuthAccessForHost(Number(id));
+    return NextResponse.json(access);
+  } catch (error) {
+    return apiErrorResponse(error);
+  }
+}
+
+export async function PUT(request: NextRequest, { params }: Params) {
+  try {
+    const { userId } = await requireApiAdmin(request);
+    const { id } = await params;
+    const body = await request.json();
+    const access = await setForwardAuthAccess(
+      Number(id),
+      { userIds: body.userIds, groupIds: body.groupIds },
+      userId
+    );
+    return NextResponse.json(access);
+  } catch (error) {
+    return apiErrorResponse(error);
+  }
+}