feat(vNext.4): implement trusted-subject security chain for portal user key self-service

- Add portal_auth.go: Portal user session auth with HMAC-signed cookies
- Add /api/portal/session/{login,logout,state} endpoints
- Update nginx config template: cookie-to-header trusted proxy pattern
- Update frontend: sync CRM session on login/logout
- Add TRUSTED_SUBJECT_DEPLOY_GUIDE.md with remote43 deployment steps
- Update EXECUTION_BOARD.md: mark trusted-subject blocking issue as resolved

This implements the secure chain:
  Browser → Portal → nginx (cookie→header) → CRM (verify proxy secret)

Required remote43 actions:
1. Generate 64-char hex secret
2. Update .env.crm with TRUSTED_* config
3. Update nginx with cookie map and header injection
4. Restart services

Fixes EXECUTION_BOARD.md 2026-06-08 blocking issue

internal/app/app_test.go

@@ -141,7 +141,7 @@ func TestAPIAdminSessionLoginSetsCookieAndAuthorizesSubsequentRequest(t *testing
 		ListPacks: func(context.Context) ([]PackInfo, error) {
 			return []PackInfo{{PackID: "openai-cn-pack", Version: "1.1.6"}}, nil
 		},
-	}, "")
+	}, "", "")
 
 	loginRequest := httptestRequest(t, http.MethodPost, "/api/admin/session/login", map[string]any{
 		"username": "admin",
@@ -177,7 +177,7 @@ func TestAPIAdminSessionRejectsInvalidPassword(t *testing.T) {
 		Token:    "secret-token",
 		Username: "admin",
 		Password: "pass-123",
-	}, ActionSet{}, "")
+	}, ActionSet{}, "", "")
 	request := httptestRequest(t, http.MethodPost, "/api/admin/session/login", map[string]any{
 		"username": "admin",
 		"password": "wrong",
@@ -192,7 +192,7 @@ func TestAPIAdminSessionLogoutClearsCookie(t *testing.T) {
 		Token:    "secret-token",
 		Username: "admin",
 		Password: "pass-123",
-	}, ActionSet{}, "")
+	}, ActionSet{}, "", "")
 	request := httptestRequest(t, http.MethodPost, "/api/admin/session/logout", nil, "")
 	response := httptestRecorder(handler, request)
 	assertStatusCode(t, response, http.StatusNoContent)
@@ -219,7 +219,7 @@ func TestAPIAdminSessionMeReportsAuthenticationState(t *testing.T) {
 		Now: func() time.Time {
 			return now
 		},
-	}, ActionSet{}, "")
+	}, ActionSet{}, "", "")
 
 	request := httptestRequest(t, http.MethodGet, "/api/admin/session", nil, "")
 	response := httptestRecorder(handler, request)