feat: support arbitrary URL proxy via single token

Allow proxying to any URL through the single-token auth path:
- /TOKEN/https://target.com/path
- /TOKEN/https:/target.com/path (browser-normalized)
- /TOKEN/target.com/path (auto-prefixed with https:// for known domains)

Also fix single-mode path handling that previously dropped
parts[2] when SplitN produced 3 parts.

via [HAPI](https://hapi.run)

Co-Authored-By: HAPI <[email protected]>

internal/auth/auth.go

@@ -152,7 +152,7 @@ func ProxyAuthMiddleware(rl *RateLimiter) func(http.Handler) http.Handler {
 					if len(parts) == 1 {
 						newPath = "/"
 					} else {
-						newPath = "/" + parts[1]
+						newPath = "/" + strings.Join(parts[1:], "/")
 					}
 				}
 			}