Stop refusing sign-in over a scheme other than the public URL's

The auth routes no longer return 400 when the resolved request scheme
differs from MEALQUEST_PUBLIC_URL's. If Docker's published-port path
presents its bridge gateway instead of Traefik as the direct peer, the
forwarded headers are rightly ignored, but sign-in must still work: the
OIDC redirect URI and the Secure cookies are fixed by MEALQUEST_PUBLIC_URL,
not by the request. internal/auth is back to its state before the
trusted-proxy change; client IP and scheme resolution stays in the router.

Add TestLoginThroughRouter: it wires the real auth flow and session
manager through server.NewRouter, trusting Traefik only, and checks that
a login from Traefik and from an untrusted peer both redirect with the
redirect URI from MEALQUEST_PUBLIC_URL and set a Secure login cookie.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/auth/session_test.go

@@ -13,6 +13,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/go-chi/chi/v5"
+
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/store"
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/migrations"
 )
@@ -70,7 +72,8 @@ func newSessionHarness(t *testing.T) *sessionHarness {
 	if err != nil {
 		t.Fatal(err)
 	}
-	r := publicRouter(a, testPublicURL.Scheme)
+	r := chi.NewRouter()
+	a.Mount(r)
 	h.harness = &harness{provider: p, router: r, logs: logs}
 	h.auth = a
 	return h