Add trusted-proxy auth hardening + PHP requirements checks

Trusted-proxy hardening (defense-in-depth for Authelia forward-auth):
- AuthMiddleware now only honors Remote-* identity headers when REMOTE_ADDR
  is in a configured TRUSTED_PROXIES allowlist; otherwise it refuses with 403
  and logs an 'untrusted_proxy' security event. Previously anything that could
  reach PHP directly could spoof Remote-User/Remote-Groups and log in as admin.
- New config TRUSTED_PROXIES (comma-separated, from .env). Empty = enforcement
  off, so this is backward compatible until the allowlist is set on a host.

Requirements checks (so a PHP upgrade dropping an extension can't silently
break features like avatars again):
- config/requirements.php: single source of truth for min PHP version and
  required extensions (ldap, mysqli, curl, mbstring, fileinfo, json).
- scripts/check_requirements.php: CI script that fails the build if the
  environment doesn't satisfy them.
- New 'requirements' CI job installs those extensions and runs the check;
  deploy now depends on it.
- api/health.php: adds php_extensions + php_version checks so production
  monitoring surfaces the drift (returns 503 if a required extension is gone).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

config/config.php

@@ -60,6 +60,16 @@ $GLOBALS['config'] = [
     'DB_PASS' => $envVars['DB_PASS'] ?? '',
     'DB_NAME' => $envVars['DB_NAME'] ?? 'tinkertickets',
 
+    // Trusted reverse proxies. Authelia forward-auth (Remote-* headers) is only
+    // honored when REMOTE_ADDR is in this allowlist, so the spoofable identity
+    // headers can't be set by anything that reaches PHP directly. Comma-separated
+    // IPs in .env (e.g. TRUSTED_PROXIES=10.10.10.27). Empty = enforcement OFF
+    // (backward compatible — relies solely on network topology).
+    'TRUSTED_PROXIES' => array_values(array_filter(array_map(
+        'trim',
+        explode(',', (string)($envVars['TRUSTED_PROXIES'] ?? ''))
+    ), fn($ip) => $ip !== '')),
+
     // URL settings
     'BASE_URL' => '', // Empty since we're serving from document root
     'ASSETS_URL' => '/assets', // Assets URL