fix(auth): address Task 13 deployment review findings

backend/src/auth/auth.ts

@@ -82,6 +82,12 @@ export function authenticateSession(deps: AuthDependencies): preHandlerHookHandl
     const snapshot = captureAuthConfigSnapshot(request, deps.authentication);
     if (isPublicRoute(request)) return;
 
+    const operator = loopbackMaintenancePrincipal(request);
+    if (operator) {
+      request.principal = operator;
+      return;
+    }
+
     if (legacy) {
       await legacy(request, reply);
       if (reply.sent || !STATE_CHANGING_METHODS.has(request.method)) return;
@@ -138,6 +144,15 @@ export function authenticateSession(deps: AuthDependencies): preHandlerHookHandl
   };
 }
 
+function loopbackMaintenancePrincipal(request: FastifyRequest): PrincipalContext | undefined {
+  if (request.ip !== "127.0.0.1" && request.ip !== "::1" && request.ip !== "::ffff:127.0.0.1") return undefined;
+  if (singleHeader(request.headers["x-thoth-principal-issuer"]) !== "tht"
+    || singleHeader(request.headers["x-thoth-principal-subject"]) !== "tht-maintenance"
+    || singleHeader(request.headers["x-thoth-principal-display-name"]) !== "Tht maintenance"
+    || singleHeader(request.headers["x-thoth-is-admin"]) !== "1") return undefined;
+  return upstreamPrincipal(request.headers);
+}
+
 export function requireCsrf(request: FastifyRequest, reply: FastifyReply): true | FastifyReply {
   const expectedOrigin = request.authPublicOrigin;
   const token = request.authSessionToken;