✨ Add ForwardAuth transparent SSO authentication support

[aznszn]

Related Ticket

Summary

Steps to reproduce

Checklist

• Choose the correct target branch; use develop by default.
• Provide a brief summary of the changes introduced.
• Add a detailed explanation of how to reproduce the issue and/or verify the fix, if applicable.
• Include screenshots or videos, if applicable.
• Add or modify existing integration tests in case of bugs or new features, if applicable.
• Refactor any modified SCSS files following the refactor guide.
• Check CI passes successfully.
• Update the CHANGES.md file, referencing the related GitHub issue, if applicable.

[Copilot]

Pull request overview

Adds ForwardAuth-style transparent SSO support by trusting X-Auth-Request-* headers (when enabled via flags), plus an optional frontend logout redirect for mPass “full signout” flows.

Changes:

• Backend: introduce app.http.auth-request middleware, wire it into RPC routes, and add middleware tests.
• Frontend: allow logout to redirect to an externally provided signout URL (via runtime config.js).
• Docker: inject MPASS_SIGNOUT_URL into config.js at container start.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
frontend/src/app/main/data/auth.cljs	Redirect logout to external signout URL when configured.
frontend/src/app/config.cljs	Read penpotMpassSignoutUrl from runtime config.
docker/images/files/nginx-entrypoint.sh	Inject MPASS_SIGNOUT_URL into frontend config.js.
docker/images/files/config.js	Add runtime config placeholder for penpotMpassSignoutUrl.
backend/test/backend_tests/http_middleware_test.clj	Add tests for X-Auth-Request middleware behavior.
backend/src/app/rpc.clj	Add auth-request middleware to RPC route middleware chain.
backend/src/app/http/auth_request.clj	New middleware implementing ForwardAuth/X-Auth-Request trust + optional auto-register.
backend/src/app/config.clj	Add :smb-name config key to schema.
backend/scripts/_env	Enable new X-Auth-Request flags in dev env script.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

auth/create-profile-rels expects a DB connection as its first argument, but this code passes the full cfg map. This will break the auto-registration flow at runtime when :x-auth-request-auto-register is enabled. Pass conn (from the tx context) instead of cfg.

Suggested change

	(auth/create-profile-rels cfg profile)))))))
	(auth/create-profile-rels conn profile)))))))