feat: add header key auth as alternative to IP allowlist

Caddyfile

@@ -10,6 +10,7 @@
 # --- Access control (generated by docker-entrypoint.sh from env) ---
 # matchers.caddy: @denied_ip / @bad_token definitions (empty when disabled)
 # guard.caddy:    matching respond directives (empty when disabled)
+# scrub_extra.caddy: strips the optional auth key header from upstream requests
 
 # --- Shared upstream request hygiene ---
 (scrub) {
@@ -24,6 +25,7 @@
 	header_up -Forwarded
 	header_up -Via
 	header_up -X-Proxy-Token
+	import /etc/caddy/scrub_extra.caddy
 }
 
 # (api) <prefix> <upstream-host> <upstream-path-prefix>