feat(admin): support forward-auth remote user headers

[imnotjames]

fixes #24

This adds a new setting for a remote user header. When this is set, the header with that name is read as the authenticated user's email address.

This is meant to be used with traefik's forwardAuth or oauth2-proxy. When this is enabled, end users must not have access to the admin interface directly for security reasons, but how to prevent that kind of access is outside the scope of this PR.

This works in a similar way to the GitHub authentication mechanism for creating a new user if they are the first user and no other user exists.