feat: harden proxy OAuth authentication with enhanced security and usability

[JAORMX]

Overview

This PR enhances the proxy OAuth authentication system with security hardening, improved code quality, and better user experience based on post-merge feedback for commit aeceaa7.

Security Hardening

• ✅ Secure credential handling: Added --remote-auth-client-secret-file flag for file-based credential storage
• ✅ Environment variable support: Added TOOLHIVE_REMOTE_OAUTH_CLIENT_SECRET environment variable
• ✅ Credential precedence: Implemented secure resolution order (flag → file → env var)
• ✅ Path validation: Added filepath.Clean() validation for secure file handling
• ✅ Enhanced logging: Protected sensitive information while maintaining debuggability

Code Quality Enhancements

• ✅ Configurable timeouts: Replaced hardcoded timeouts with named constants
• ✅ Better error handling: Comprehensive error propagation and wrapping
• ✅ Separation of concerns: Refactored authentication logic into focused functions
• ✅ Documentation: Added comprehensive function documentation and inline comments
• ✅ Context optimization: Improved context handling for better resource management

Robustness Improvements

• ✅ WWW-Authenticate parsing: Complete rewrite for better compatibility
• ✅ Multi-scheme support: Added support for Bearer, Basic, and Digest authentication
• ✅ Parameter extraction: Enhanced handling of quotes and whitespace
• ✅ Production-ready defaults: Added configurable timeouts with sensible defaults
• ✅ HTTP client config: Improved timeout and transport settings

Documentation & UX

• ✅ Comprehensive docs: Added detailed command documentation with examples
• ✅ Authentication modes: Documented all credential source options
• ✅ Usage examples: Provided clear examples for different scenarios
• ✅ Security features: Detailed explanations of security best practices

Backward Compatibility

✅ All changes maintain full backward compatibility with existing configurations.

Testing

• ✅ All linting issues resolved (0 golangci-lint issues)
• ✅ Code follows security best practices
• ✅ Comprehensive error handling and validation

Examples

Basic transparent proxy

thv proxy my-server --target-uri http://localhost:8080

Proxy with OAuth authentication using file-based secret

thv proxy my-server --target-uri https://api.example.com \
  --remote-auth --remote-auth-issuer https://auth.example.com \
  --remote-auth-client-id my-client-id \
  --remote-auth-client-secret-file /path/to/secret

Using environment variable for secret

export TOOLHIVE_REMOTE_OAUTH_CLIENT_SECRET="your-secret"
thv proxy my-server --target-uri https://api.example.com \
  --remote-auth --remote-auth-issuer https://auth.example.com \
  --remote-auth-client-id my-client-id

Changes Summary

• Files changed: 1
• Insertions: +184
• Deletions: -30
• Net addition: +154 lines

This enhancement significantly improves the security posture, reliability, and maintainability of the authentication system while providing a better user experience.