feat: path /secret auth + forwardedClientId + WS event metrics

[snowkide]

Summary

• forwardedClientId strategy for gateway-injected X-Client-Id (Envoy apiKeyAuth mode).
• Path /<secret> and apikey query/header aliases remain available but CLL .com uses Envoy ?apikey= + forwardedClientId.
• WS subscription event counters labeled with network alias.

Test plan

• go test ./auth/
• Publish image to GHCR

[github-actions]

	File	Lines	Key changes	Risk
🟠	strategy_forwarded_client_id.go	+40/-0	ForwardedClientIdStrategy, NewForwardedClientIdStrategy, Supports, ...	⚠ ErrAuthUnauthorized
🟠	authorizer.go	+5/-0	—	⚠ ErrInvalidConfig
🟠	strategy_secret.go	+9/-0	—	⚠ ErrAuthUnauthorized
🔵	adapter.go	+50/-2	SubscriptionLabels, AddSubscription, subscriptionNetworkLabel, ...
🔵	http.go	+57/-1	NewPayloadFromHttp, singlePathSegmentSecret, firstNonEmptyHeader
🔵	config.go	+27/-11	ForwardedClientIdStrategyConfig, ForwardedClientIdStrategyConfig
🔵	request.go	+25/-0	SetTransport, Transport
🔵	payload.go	+12/-5	ForwardedClientIdPayload
🔵	defaults.go	+17/-0	SetDefaults
🔵	validation.go	+22/-1	Validate
	2 test files	+105

_{xray — see through AI slop with deterministic architecture PR diff reviews}

[snowkide]

Follow-up: transport label for CLL rpc_ws_event_count_total

CLL sheet defines rpc_ws_event_count_total as RPC calls via WSS, not subscription pushes.

This branch now:

• sets NormalizedRequest.transport = "ws" on WebSocket ingress
• adds transport (http|ws) on erpc_network_request_received_total

Infra PR will remap recording rules:

• rpc_http_requests_total ← transport!="ws"
• rpc_ws_event_count_total ← transport="ws"

erpc_ws_subscription_events_total stays as an internal ops metric for push notifications.