Forward-Auth with Intercept header authentication not behaving like documented

**Describe the bug**
It seems that when you have configured single app forward auth, to use Intercept header authentication, and the header is either missing or invalid, it just shows an 401.

**To Reproduce**
Steps to reproduce the behavior:

1. Create a new single forward auth app
2. Use ingress-nginx and configure the app to be secured
3. Try to browse to the app url
4. See the 401 instead of normal login page

**Expected behavior**
I would have expected it to behave like documented which is `when Intercept header authentication is enabled, authentik will intercept the authorization header. If the authorization header value is invalid, an error response will be shown with a 401 status code. Requests without an authorization header will still be redirected to the standard login flow.`

I would have expected it to behave more like Authelia where it would also show an password prompt if it's asking for basic auth.

**Version and Deployment (please complete the following information):**

- authentik version: 2024.12.1
- Deployment: Helm

**Additional context**

The ingress manifest used:
```yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: dh
namespace: networking
annotations:
external-dns.alpha.kubernetes.io/target: ""
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
nginx.ingress.kubernetes.io/auth-url: |-
http://ak-outpost-authentik-embedded-outpost.security.svc.cluster.local:9000/outpost.goauthentik.io/auth/nginx
nginx.ingress.kubernetes.io/auth-response-headers: |-
Set-Cookie,X-authentik-username,X-authentik-groups
nginx.ingress.kubernetes.io/auth-snippet: |
proxy_set_header X-Forwarded-Host $http_host;
nginx.ingress.kubernetes.io/server-snippet: |
proxy_ssl_name .fi;
proxy_ssl_server_name on;
spec:
ingressClassName: external-nginx
rules:
- host: ".fi"
http:
paths:
- pathType: Prefix
path: "/"
backend:
service:
name: dh
port:
number: 443
tls:
- hosts:
- ".fi"
```

Start by reproducing the behavior with the provided ingress manifest and the single-app forward-auth flow, focusing on the Intercept header authentication handling. Compare requests with missing and invalid authorization headers against the documented behavior; done means missing headers reach the standard login redirect while invalid headers still return 401 responses.

Written by the indexing model from the issue text.