Add trusted-proxy auth hardening + PHP requirements checks

Trusted-proxy hardening (defense-in-depth for Authelia forward-auth):
- AuthMiddleware now only honors Remote-* identity headers when REMOTE_ADDR
  is in a configured TRUSTED_PROXIES allowlist; otherwise it refuses with 403
  and logs an 'untrusted_proxy' security event. Previously anything that could
  reach PHP directly could spoof Remote-User/Remote-Groups and log in as admin.
- New config TRUSTED_PROXIES (comma-separated, from .env). Empty = enforcement
  off, so this is backward compatible until the allowlist is set on a host.

Requirements checks (so a PHP upgrade dropping an extension can't silently
break features like avatars again):
- config/requirements.php: single source of truth for min PHP version and
  required extensions (ldap, mysqli, curl, mbstring, fileinfo, json).
- scripts/check_requirements.php: CI script that fails the build if the
  environment doesn't satisfy them.
- New 'requirements' CI job installs those extensions and runs the check;
  deploy now depends on it.
- api/health.php: adds php_extensions + php_version checks so production
  monitoring surfaces the drift (returns 503 if a required extension is gone).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/check_requirements.php

@@ -0,0 +1,44 @@
+#!/usr/bin/env php
+<?php
+
+/**
+ * Verify the running PHP environment meets the declared runtime requirements.
+ *
+ * Reads config/requirements.php and checks the PHP version and that every
+ * required extension is loaded. Exits non-zero (failing CI) on any miss.
+ *
+ * Usage: php scripts/check_requirements.php
+ */
+
+$req = require __DIR__ . '/../config/requirements.php';
+
+$errors = [];
+
+// PHP version
+$minPhp = $req['min_php_version'];
+if (version_compare(PHP_VERSION, $minPhp, '<')) {
+    $errors[] = sprintf('PHP %s is below the required minimum %s', PHP_VERSION, $minPhp);
+}
+
+// Required extensions
+foreach ($req['required_extensions'] as $ext) {
+    if (!extension_loaded($ext)) {
+        $errors[] = sprintf('Missing required PHP extension: %s', $ext);
+    }
+}
+
+if (!empty($errors)) {
+    fwrite(STDERR, "Requirement check FAILED:\n");
+    foreach ($errors as $err) {
+        fwrite(STDERR, '  - ' . $err . "\n");
+    }
+    exit(1);
+}
+
+printf(
+    "Requirement check passed: PHP %s (>= %s); extensions: %s\n",
+    PHP_VERSION,
+    $minPhp,
+    implode(', ', $req['required_extensions'])
+);
+exit(0);