Implements nginx auth_request compatible endpoints so any service behind the ingress can be gated behind ATAuth login without code changes. New endpoints: - GET /auth/verify - nginx auth_request target (checks cookie or ticket) - GET/POST /auth/proxy/login - login entry point with silent SSO - GET /auth/proxy/callback - AT Proto OAuth callback for proxy flow - GET /auth/proxy/logout - centralized session logout Admin API additions: - CRUD for allowed origins (proxy/origins) - List/revoke proxy sessions (proxy/sessions) Also fixes CSP nonce on OIDC login page inline scripts. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>