Add public access mode (public=1) to forward auth

/auth/api/forward?public=1 passes requests through with a Remote-Public
header (anonymous/forbidden/authenticated) instead of 401/403, so routes
can allow anonymous visitors while still identifying logged-in users.
Reauth (max_age) still requires the auth flow. Documented in Headers.md,
api/forward.md, Integration.md and all proxy guides.

caddy/auth/require

@@ -2,11 +2,13 @@
 # Argument is mandatory and provides a query string to /auth/api/forward
 #   "" means just authentication
 #   perm=yourservice:login to require specific permission
+#   public=1 to allow public access (backend must check Remote-Public)
 forward_auth {$AUTH_UPSTREAM:localhost:4401} {
     uri /auth/api/forward?{args[0]}
     header_up Connection keep-alive  # Much higher performance
     header_up -Upgrade  # Disable Upgrade: WebSocket
     copy_headers {
+        Remote-Public
         Remote-User
         Remote-Name
         Remote-Groups