fix(auth): local sign-in works behind trusted HTTPS proxies

[vincentkoc]

Supersedes the cookie-policy approach in #171. That draft remains open and untouched pending maintainer reconciliation.

What Problem This Solves

Fixes an issue where local sign-in could lose OAuth state when an untrusted forwarded-scheme header forced Secure cookies onto loopback HTTP. It also resolves CodeQL alerts 1 and 2 for authentication cookies that did not have a statically guaranteed Secure policy.

Why This Change Was Made

HTTPS is now derived from direct TLS or a verified loopback proxy with one unambiguous forwarded protocol value. Both authentication cookies share that decision, all configured HTTPS public surfaces force Secure cookies, and intentional loopback HTTP development remains supported without adding configuration.

The accepted proxy contract is the repository's existing bundled Nginx example: it overwrites Host, X-Forwarded-For, X-Real-IP, and X-Forwarded-Proto before forwarding to the loopback API. Other proxy topologies must use configured public URLs or establish their own verified edge identity.

User Impact

Local OAuth sign-in continues to work over loopback HTTP, trusted local reverse proxies produce HTTPS callback URLs and Secure cookies, and arbitrary forwarded headers can no longer influence the scheme decision.

Evidence

• Pre-fix Crabbox proof: TestSessionCookiesDefaultSecureOutsideLocalDev failed for spoofed forwarding and the OpenClaw ID HTTPS sibling: https://crabbox.openclaw.ai/portal/runs/run_7dda5d05b008
• Final focused formatting and authentication-cookie/scheme tests: https://crabbox.openclaw.ai/portal/runs/run_05e222be6b78
• Full Go suite with one named pre-existing Crabbox filesystem-mode test skipped: https://crabbox.openclaw.ai/portal/runs/run_e90900b4bd85
• Untouched main at 5c664e0dbe32ca12694e1782baa76baa989e36e5 reproduces that unrelated TestWriteClientConfigFilePreservesWritableMode failure: https://crabbox.openclaw.ai/portal/runs/run_f5587c9ac47e
• Production LOC: +31/-20. Tests: +183/-5.
• Independent high-reasoning security review and test audit found no actionable P0-P2 findings after the review fixes.
• ClawSweeper exact-head review completed with no code findings, security review cleared, focused live proof passed, and both rank-up moves addressed.
• Proxy contract source: deploy/nginx/clickclack.conf.example:67-70 and docs/deployment.md:171-184.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: fix(auth): local sign-in works behind trusted HTTPS proxies This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.