refs #709: replace portal query token with HttpOnly auth

poc4_active_source_20260714/infra/nginx/hmm-portal-auth.locations.conf

@@ -0,0 +1,41 @@
+location = /auth/check {
+    internal;
+    proxy_pass http://127.0.0.1:8621/auth/check;
+    proxy_pass_request_body off;
+    proxy_set_header Content-Length "";
+    proxy_set_header Cookie $http_cookie;
+    proxy_set_header X-Real-IP $remote_addr;
+}
+
+location /auth/ {
+    proxy_pass http://127.0.0.1:8621;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+}
+
+location @hmm_portal_login {
+    return 302 /auth/login;
+}
+
+location / {
+    auth_request /auth/check;
+    error_page 401 = @hmm_portal_login;
+    auth_request_set $hmm_auth_user $upstream_http_x_auth_user;
+    auth_request_set $hmm_auth_expires $upstream_http_x_auth_expires;
+
+    proxy_pass http://127.0.0.1:8622;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-HMM-Authenticated-User $hmm_auth_user;
+    proxy_set_header X-HMM-Auth-Expires $hmm_auth_expires;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+    proxy_read_timeout 300;
+    proxy_send_timeout 300;
+}