feat(http): optional X-Forwarded-Host support for host authorization

[hugodutka]

Summary:

• Adds --use-x-forwarded-host CLI flag and ServerConfig.UseXForwardedHost.
• When enabled, hostAuthorizationMiddleware prefers X-Forwarded-Host (first value, before comma), extracts hostname via url.Parse and matches against AllowedHosts (case-insensitive, ignoring port). Falls back to r.Host if header is absent.
• Adds tests covering enabled/disabled behavior, port in header, IPv6 literal, and comma-separated header values.
• CLI tests updated to assert default false, env var (AGENTAPI_USE_X_FORWARDED_HOST) parsing, and CLI override precedence.
• README: documents the new flag and env var with guidance on trusted proxy usage.

Notes:

• Semantics mirror Django’s USE_X_FORWARDED_HOST gating, but limited to Host selection only.
• No behavior change when the flag is false (default).

Testing:

• go test ./... passes locally.