feat: add captive portal (zero-trust proxy) authentication support

Hello all, This MR detects when the server is behind a zero-trust proxy (Cloudflare Access, Authelia, etc.) and present an embedded browser for authentication. Cookies are persisted and forwarded to all request paths including audio streaming. Session is cleared on explicit logout but preserved on token expiry for seamless re-authentication. It's slightly related to https://github.com/BLeeEZ/amperfy/pull/694 - I just thought it would be useful for those who don't want to generate a private key. Thanks!