Pure Rack middleware that reads forward-auth headers (Remote-User, Remote-Email, Remote-Groups, Remote-Name) and exposes parsed user attributes in the Rack env. Includes a test stub for development environments. No Rails dependency.