Auto-login from trusted reverse-proxy Authentik headers

When SSO_GATEWAY_SECRET is set and an incoming request carries both
X-Artifacto-Gateway (matching the secret) and X-Authentik-Username, the
admin middleware mints a session automatically so Authentik-authenticated
users skip the password form. Missing or wrong gateway header falls back
to the password-login flow, so peers that can reach the container
directly (bypassing the reverse proxy) cannot spoof Authentik identities.

cmd/artifacto/main.go

@@ -28,6 +28,7 @@ func main() {
 	baseURL := envOr("BASE_URL", "http://localhost:3000")
 	adminPw := os.Getenv("ADMIN_PASSWORD")
 	sessionSecret := os.Getenv("SESSION_SECRET")
+	ssoSecret := os.Getenv("SSO_GATEWAY_SECRET")
 	maxMB, _ := strconv.ParseInt(envOr("MAX_UPLOAD_MB", "5"), 10, 64)
 
 	if sessionSecret == "" {
@@ -46,7 +47,7 @@ func main() {
 	defer s.Close()
 
 	secure := strings.HasPrefix(baseURL, "https://")
-	admin, err := auth.NewAdmin(adminPw, sessionSecret, secure)
+	admin, err := auth.NewAdmin(adminPw, sessionSecret, ssoSecret, secure)
 	if err != nil {
 		logger.Error("init admin auth", "err", err)
 		os.Exit(1)