Auto-login from trusted reverse-proxy Authentik headers

When SSO_GATEWAY_SECRET is set and an incoming request carries both
X-Artifacto-Gateway (matching the secret) and X-Authentik-Username, the
admin middleware mints a session automatically so Authentik-authenticated
users skip the password form. Missing or wrong gateway header falls back
to the password-login flow, so peers that can reach the container
directly (bypassing the reverse proxy) cannot spoof Authentik identities.

internal/server/admin.go

@@ -19,6 +19,16 @@ func (s *Server) getLogin(w http.ResponseWriter, r *http.Request) {
 		http.Redirect(w, r, "/", http.StatusSeeOther)
 		return
 	}
+	// SSO: trusted gateway has proven identity — mint a session and skip the form.
+	if s.admin.HasValidSSO(r) {
+		s.admin.SetCookie(w)
+		next := r.URL.Query().Get("next")
+		if next == "" {
+			next = "/"
+		}
+		http.Redirect(w, r, next, http.StatusSeeOther)
+		return
+	}
 	s.render(w, "login", loginData{Next: r.URL.Query().Get("next")})
 }