Honour forwarded headers only from MEALQUEST_TRUSTED_PROXY

Add internal/forwarded: parse the trusted proxy list (comma-separated IPs
and CIDRs, validated at load), resolve each request's client IP and scheme,
and expose them through context helpers. X-Forwarded-For and
X-Forwarded-Proto are honoured only when the TCP peer is trusted; the client
is the rightmost X-Forwarded-For address that is not a trusted proxy.
Malformed forwarded headers from a trusted peer get 400.

The router resolves every request first; a slog handler adds client_ip to
request-scoped log lines. The auth routes refuse requests whose resolved
scheme differs from MEALQUEST_PUBLIC_URL's, so a proxy that is not trusted
fails loudly instead of breaking Secure cookies. The OIDC redirect URI is
still built only from MEALQUEST_PUBLIC_URL.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/auth/session_test.go

@@ -13,8 +13,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/go-chi/chi/v5"
-
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/store"
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/migrations"
 )
@@ -72,8 +70,7 @@ func newSessionHarness(t *testing.T) *sessionHarness {
 	if err != nil {
 		t.Fatal(err)
 	}
-	r := chi.NewRouter()
-	a.Mount(r)
+	r := publicRouter(a, testPublicURL.Scheme)
 	h.harness = &harness{provider: p, router: r, logs: logs}
 	h.auth = a
 	return h