feat(gateway-api): GitHub SSO via oauth2-proxy in front of dsh-gateway (#13)

Add oauth2-proxy (GitHub provider, org-restricted) as a reverse proxy in
front of the dsh-gateway, wired through the Traefik Gateway API. The gateway
inherits the authenticated GitHub username via X-Forwarded-User (SSO).

- gateway.py: opt-in AUTH_PROXY_HEADER trust, remote_user(), SSO bootstrap
  (auto-provision claim + mint/rotate token + session cookie), patch_token()
- 50-gateway.yaml: AUTH_PROXY_HEADER=X-Forwarded-User, COOKIE_SECURE=true
- gateway-api/dsh-demo: oauth2-proxy Deployment/Service + secret example,
  HTTPRoute backend -> oauth2-proxy:4180
- tests: 10 new SSO cases (106 passing)

Placeholders (dsh-demo.example.com, your-github-org) are substituted at
apply time.

Co-authored-by: SREDevOpsAgents <agents@sredevops.org>

examples/dsh-agents-as-a-service/50-gateway.yaml

@@ -118,7 +118,14 @@ spec:
             # 60-ingress.yaml with TLS); "false" keeps the plain-HTTP demo
             # usable via port-forward.
             - name: COOKIE_SECURE
-              value: "false"
+              value: "true"
+            # Trusted reverse-proxy identity header for SSO. oauth2-proxy sets
+            # X-Forwarded-User to the authenticated GitHub login on every request;
+            # the gateway trusts it (and auto-provisions the user) only when this
+            # is set. Remove/unset to disable SSO and fall back to bearer/session
+            # auth only.
+            - name: AUTH_PROXY_HEADER
+              value: X-Forwarded-User
             # Reject proxied request bodies larger than this (413).
             - name: MAX_BODY_MB
               value: "32"