Stop refusing sign-in over a scheme other than the public URL's

The auth routes no longer return 400 when the resolved request scheme
differs from MEALQUEST_PUBLIC_URL's. If Docker's published-port path
presents its bridge gateway instead of Traefik as the direct peer, the
forwarded headers are rightly ignored, but sign-in must still work: the
OIDC redirect URI and the Secure cookies are fixed by MEALQUEST_PUBLIC_URL,
not by the request. internal/auth is back to its state before the
trusted-proxy change; client IP and scheme resolution stays in the router.

Add TestLoginThroughRouter: it wires the real auth flow and session
manager through server.NewRouter, trusting Traefik only, and checks that
a login from Traefik and from an untrusted peer both redirect with the
redirect URI from MEALQUEST_PUBLIC_URL and set a Secure login cookie.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/ARCHITECTURE.md

@@ -34,9 +34,9 @@ Traefik terminates TLS. The service honours `X-Forwarded-For` and
 (comma-separated IPs/CIDRs; production lists `10.60.1.33`); from any other
 peer they are ignored. The client is the rightmost `X-Forwarded-For` address
 that is not a trusted proxy. The resolved client IP is added as `client_ip`
-to every log line written while handling a request, and the auth routes
-refuse requests whose resolved scheme differs from `MEALQUEST_PUBLIC_URL`'s. The OIDC redirect URI is always built
-from `MEALQUEST_PUBLIC_URL`, never from request headers.
+to every log line written while handling a request. The OIDC redirect URI
+and the Secure cookies are fixed by `MEALQUEST_PUBLIC_URL`, never by request
+headers, so sign-in works whichever peer the request arrives from.
 
 ## Repository layout