fix(frontend): WithAuthFrom must also forward Remote-User header to backend

[strausmann]

Problem

PR #130 added X-Pangolin-Token forwarding in WithAuthFrom but the backend's Pangolin-SSO auth path requires both Remote-User AND X-Pangolin-Token.

Backend checks (app/auth/dependencies.py _has_pangolin_sso_session):

• user_value = request.headers.get('Remote-User', '')
• token_value = request.headers.get('X-Pangolin-Token', '')
• if user_value AND token_value == trust_token: return True <- BOTH required

Frontend forwards (WithAuthFrom): X-Label-Hub-Key, X-Pangolin-User, X-Pangolin-Token, Authorization
Remote-User is missing.

Symptom

Dashboard 503: 'Could not reach backend: ListPrinters: status 401'
Backend logs: GET /api/printers 401 from frontend IP (10.245.10.2)
Verified: Remote-User + X-Pangolin-Token -> 200 OK, only X-Pangolin-Token -> 401

Fix

Add Remote-User to WithAuthFrom forwarded headers:
for _, h := range []string{"X-Label-Hub-Key", "X-Pangolin-User", "X-Pangolin-Token", "Remote-User", "Authorization"} {

Also consider: backend could accept X-Pangolin-Token alone (without Remote-User) as sufficient trust signal.

Context

• hhdocker03, stack hangar-print-hub, Dockhand env 10
• Pangolin Resource 123 (labels.strausmann.cloud)
• Found during PR fix(frontend): forward X-Pangolin-Token zum Backend (Browser-User 503-Fix) #130 deployment verification (2026-06-23)
• Backend revision 5fb2038 is correct, frontend image 616be51 is running