[JulioRamos0]

Description

This PR adds support for passing target tickets via the custom X-Warpgate-Ticket HTTP header, in addition to the existing Authorization: Warpgate <ticket> header and ?warpgate-ticket=<ticket> query parameter.

Motivation & Problem

When proxying requests to an upstream target that requires its own HTTP authentication (such as Authorization: Basic <credentials> or upstream bearer tokens), a conflict arises. According to RFC 7235 / RFC 9110, HTTP requests cannot reliably carry multiple Authorization headers—most HTTP clients, libraries, and reverse proxies merge, overwrite, or reject requests with duplicate Authorization headers.

Because of this collision:

• Using Authorization: Warpgate <ticket> overrides the target's Authorization: Basic ... header.
• Passing tickets via URL query parameter (?warpgate-ticket=...) is often undesirable for security or caching reasons (URLs get logged in access logs, referrers, and browser histories).

Introducing X-Warpgate-Ticket: <ticket> resolves this conflict cleanly, allowing clients to authenticate against Warpgate while preserving the standard Authorization header for the upstream target.

Changes:

• warpgate-common / warpgate-common-http: Defined and re-exported X_WARPGATE_TICKET (x-warpgate-ticket). As an x-warpgate-* header, it is automatically stripped before forwarding requests upstream via may_forward_header.
• warpgate-protocol-http: Updated TicketMiddleware to check for X-Warpgate-Ticket if Authorization: Warpgate is not present, instantiating the temporary session identically to the existing header.
• warpgate-web: Updated connection instructions in the web UI to display the X-Warpgate-Ticket header option alongside the Authorization header.
• tests: Added e2e test assertion in test_http_user_auth_ticket.py verifying successful target access using X-Warpgate-Ticket.

AI Usage

Choose the level of AI involvement for this PR.

• Fully vibe coded
• AI-designed, AI-coded, manually checked
• Human-designed, AI-coded
• Human-designed, human-coded (includes AI autocompletions and boilerplate gen)

_{This is not to block AI contributions but rather to speed up PR review (saves time on trying to deduce the logic behind AI hallucinations).}