Add trusted-proxy auth hardening + PHP requirements checks

Trusted-proxy hardening (defense-in-depth for Authelia forward-auth):
- AuthMiddleware now only honors Remote-* identity headers when REMOTE_ADDR
  is in a configured TRUSTED_PROXIES allowlist; otherwise it refuses with 403
  and logs an 'untrusted_proxy' security event. Previously anything that could
  reach PHP directly could spoof Remote-User/Remote-Groups and log in as admin.
- New config TRUSTED_PROXIES (comma-separated, from .env). Empty = enforcement
  off, so this is backward compatible until the allowlist is set on a host.

Requirements checks (so a PHP upgrade dropping an extension can't silently
break features like avatars again):
- config/requirements.php: single source of truth for min PHP version and
  required extensions (ldap, mysqli, curl, mbstring, fileinfo, json).
- scripts/check_requirements.php: CI script that fails the build if the
  environment doesn't satisfy them.
- New 'requirements' CI job installs those extensions and runs the check;
  deploy now depends on it.
- api/health.php: adds php_extensions + php_version checks so production
  monitoring surfaces the drift (returns 503 if a required extension is gone).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/lint.yml

@@ -35,10 +35,27 @@ jobs:
       - name: Run ESLint
         run: npx eslint assets/js/
 
+  requirements:
+    name: PHP requirements (version + extensions)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Install PHP with required extensions
+        run: |
+          apt-get update -qq
+          # Install the extensions declared in config/requirements.php so the
+          # check verifies they are actually installable + loadable, and so this
+          # build fails if a required extension can't be provided.
+          apt-get install -y -qq php-cli php-ldap php-mysql php-curl php-mbstring
+
+      - name: Verify runtime requirements
+        run: php scripts/check_requirements.php
+
   deploy:
     name: Deploy
     runs-on: ubuntu-latest
-    needs: [php-lint, js-lint]
+    needs: [php-lint, js-lint, requirements]
     if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/development')
     permissions:
       contents: write
@@ -77,7 +94,7 @@ jobs:
   notify-failure:
     name: Notify on failure
     runs-on: ubuntu-latest
-    needs: [php-lint, js-lint]
+    needs: [php-lint, js-lint, requirements]
     if: failure() && github.event_name == 'push'
     steps:
       - name: Send Matrix alert