Forward-auth in front of apps served on a URL subpath

## What

proxy/forward-auth in front of apps served on a URL subpath (redirect/callback and “protect subpaths”).

## Want

- Proxy/forward-auth in front of apps served on a URL subpath (redirect/callback
- “protect subpaths”)

## Ideas this came from

- [#2305 Proxy/Forward auth with applications in subpaths](https://github.com/goauthentik/authentik/issues/2305) — When accessing an URL behind an Authentik proxy provider, if the URL contains a subfolder the browser gets redirected to a wrong URL. To Reproduce Steps to repr
- [#8431 Add possibility to protect subpathes](https://github.com/goauthentik/authentik/issues/8431) — I'm using multiple apps which right nor require app1.domain.tld app2.domain.tld etc... However, they are all routing to the same PC, but different docker contai

The issue names no files or tests; start by tracing the existing proxy/forward-auth redirect, callback, and subpath-protection entry points, using the two linked issues as reproduction context. Done means applications mounted below a URL subpath keep correct redirect and callback URLs, and requested subpaths can be protected.

Written by the indexing model from the issue text.