ipx-web drops the header TRUSTED_HEADER names from anyone but the tunnel (#323)

ipx trusts [web] trusted_header from Caddy's address, and Caddy
stripped only the two Cf-Access-* names from requests not from
TUNNEL_PEER. With trusted_header set to anything else (X-Remote-User
for another proxy), a request through ipx-web carried it to ipx as
Caddy's and was believed: anyone could sign in as anyone.

TRUSTED_HEADER, defaulting to Cloudflare's name, is stripped the same
way. Production uses Cloudflare's header and sets nothing, so it
behaves as before. caddy adapt shows the delete list with and without.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/Caddyfile

@@ -78,6 +78,9 @@ http://{$WEB_BIND::8080} {
 	@forged not remote_ip {$TUNNEL_PEER:255.255.255.255}
 	request_header @forged -Cf-Access-Authenticated-User-Email
 	request_header @forged -Cf-Access-Jwt-Assertion
+	# Whatever header ipx's [web] trusted_header names, when it is not Cloudflare's: ipx trusts it
+	# from this address, and anyone could send it through here (#323).
+	request_header @forged -{$TRUSTED_HEADER:Cf-Access-Authenticated-User-Email}
 
 	@api path /api/* /media/*
 	handle @api {