Support reverse-proxy trusted header authentication (SSO behind Authelia / Authentik / oauth2-proxy)

I have searched the existing feature requests, both open and closed, to make sure this is not a duplicate request. • Yes The feature Description Many Immich deployments sit behind a reverse proxy that already authenticates users (Authelia, Authentik, oauth2-proxy, Keycloak gate, Cloudflare Access, etc.). In that setup, the proxy injects identity headers on every request (for example X-Forwarded-Email, Remote-User, or configurable equivalents). Today Immich only offers password login and its own OIDC client. Even when the user is already authenticated at the proxy, Immich still shows its login page and requires a second authentication (local password or a full Immich→IdP OAuth round-trip). This is a common “SSO at the edge” pattern used by many self-hosted apps (e.g. Open WebUI’s WEBUI_AUTH_TRUSTED_* headers). We would like Immich to optionally trust those proxy headers and map them to an Immich user session without a second interactive login. Why this matters 1. …