fix: support login through SSO reverse proxies in the WebView

[andig]

fixes #35, fixes #140

evcc behind an auth proxy (oauth2-proxy, Authentik, Authelia, Cloudflare Access) could not be added: the server check hit the proxy's login page instead of evcc, and the WebView kicked the identity provider's login page out to the system browser, where the session cookie never reached the WebView. This adds an explicit opt-in per server so the strict compatibility check stays in place for everyone else.

• New "Login via reverse proxy" toggle in the server form. With it on, the check only requires the address to be reachable; a login page (302 to another origin, 401/403 or a same-host form) is accepted and the entered URL is saved as-is.
• For such servers the WebView keeps cross-origin navigations in-app until the evcc UI reports online, so the whole SSO round trip (proxy → IdP → callback → evcc) runs in one cookie jar. Afterwards foreign links open externally as before.
• The login page is shown instead of the loading overlay, and 401/403 no longer trigger the offline/remount loop for these servers. The evcc UI reports online by itself once the login went through; an expired session simply lands on the login page again after the next reload.
• Caddyfile gains a fake auth proxy (:7090) plus identity provider on a separate origin (:7091); a Detox test logs in through it inside the WebView on both platforms.

Scope and known limits:

• Google as identity provider refuses sign-in from embedded WebViews (disallowed_useragent). GitHub, email/OTP, Keycloak, Authentik/Authelia local accounts work. Not fixable app-side without a token handoff the proxy would have to support.
• Widgets keep using basic auth only; SSO-protected servers stay unsupported there.
• Deep links (evcc://server?…) do not prefill the toggle yet.