Add reverse proxy header security and forwarding

- Rewrite Host header to backend target (configurable via pass_host_header per mapping)
- Strip and set X-Forwarded-For/X-Real-IP from direct connection (trust boundary)
- Set X-Forwarded-Host and X-Forwarded-Proto headers
- Strip nb_session cookie and session_token query param before forwarding
- Add --forwarded-proto flag (auto/http/https) for proto detection
- Fix OIDC redirect hardcoded https scheme
- Add pass_host_header to proto, API, and management model

shared/management/http/api/openapi.yml

@@ -2857,6 +2857,9 @@ components:
         enabled:
           type: boolean
           description: Whether the reverse proxy is enabled
+        pass_host_header:
+          type: boolean
+          description: When true, the original client Host header is passed through to the backend instead of being rewritten to the backend's address
         auth:
           $ref: '#/components/schemas/ReverseProxyAuthConfig'
         meta:
@@ -2914,6 +2917,9 @@ components:
           type: boolean
           description: Whether the reverse proxy is enabled
           default: true
+        pass_host_header:
+          type: boolean
+          description: When true, the original client Host header is passed through to the backend instead of being rewritten to the backend's address
         auth:
           $ref: '#/components/schemas/ReverseProxyAuthConfig'
       required:

shared/management/http/api/types.gen.go

@@ -1983,6 +1983,9 @@ type ReverseProxy struct {
 	// Name Reverse proxy name
 	Name string `json:"name"`
 
+	// PassHostHeader When true, the original client Host header is passed through to the backend instead of being rewritten to the backend's address
+	PassHostHeader *bool `json:"pass_host_header,omitempty"`
+
 	// ProxyCluster The proxy cluster handling this reverse proxy (derived from domain)
 	ProxyCluster *string `json:"proxy_cluster,omitempty"`
 
@@ -2056,6 +2059,9 @@ type ReverseProxyRequest struct {
 	// Name Reverse proxy name
 	Name string `json:"name"`
 
+	// PassHostHeader When true, the original client Host header is passed through to the backend instead of being rewritten to the backend's address
+	PassHostHeader *bool `json:"pass_host_header,omitempty"`
+
 	// Targets List of target backends for this reverse proxy
 	Targets []ReverseProxyTarget `json:"targets"`
 }