Feature request: Add trusted proxy header authentication as an alternative to OIDC

Feature request #1689 covers adding OIDC support for user authentication, which will be great when implemented.

As a step short of full OIDC support, it would also be useful for Checkmate to support optional trusted-header authentication for deployments behind an auth proxy such as [oauth2-proxy](https://github.com/oauth2-proxy/oauth2-proxy). This can be a simple and practical way to avoid setting up a direct OIDC integration in every deployment.

That would allow a trusted reverse proxy to handle OAuth/OIDC and pass user identity to Checkmate via headers such as `X-Forwarded-User`.

A good preexisting example of this kind of implementation is the `REMOTE_USER_HEADER` feature [supported by Healthchecks](https://github.com/healthchecks/healthchecks?tab=readme-ov-file#external-authentication).

Start by locating Checkmate’s existing authentication entry point and reviewing the OIDC work referenced in issue #1689. Compare the requested trusted-header flow with oauth2-proxy and Healthchecks’ REMOTE_USER_HEADER example; done means an optional header-based authentication path with behavior covered by appropriate tests.

Written by the indexing model from the issue text.