Add sso-diagnose.sh: verify all peertube-sso-incident claims into a log

- docs: record the open identity-forwarding question, auth contracts, and responsibility boundary

scripts/echo-headers.php

@@ -0,0 +1,51 @@
+<?php
+/**
+ * echo-headers.php — request-side identity probe for the SSO diagnosis.
+ *
+ * The ONLY reliable way to see the identity header LemonLDAP injects into the
+ * request IT forwards to the backend is to place an endpoint *behind* the same
+ * reverse proxy (same vhost as PeerTube) and have it echo the request headers.
+ * Response headers on the public site can never reveal this.
+ *
+ * Deploy this file anywhere served through the SAME LemonLDAP vhost that
+ * protects videos.erg.be (e.g. a static location, or a tiny PHP handler on the
+ * backend), authenticate at portail.erg.school, then hit it — it returns JSON
+ * of every inbound header. Forward the resulting URL to sso-diagnose.sh:
+ *
+ *   scripts/sso-diagnose.sh --echo 'https://videos.erg.be/path/to/echo-headers.php'
+ *
+ * Output (subset):
+ *   {
+ *     "headers": { "X-Remote-User": "jsmith", "Auth-User": "jsmith", ... },
+ *     "server":  { "REMOTE_USER": "...", ... }
+ *   }
+ *
+ * It also mirrors the CGI subprocess environment (REMOTE_USER, etc.), which is
+ * where Apache/LemonLDAP often land the identity. Safe: emits NO secret — only
+ * the incoming headers it was handed.
+ */
+
+header('Content-Type: application/json; charset=utf-8');
+header('Cache-Control: no-store');
+
+$headers = [];
+foreach ($_SERVER as $k => $v) {
+    if (str_starts_with($k, 'HTTP_')) {
+        $name = str_replace('_', '-', substr($k, 5));
+        $headers[$name] = $v;
+    }
+}
+
+// Also surface the classic CGI environment identity vars directly.
+$server = [
+    'REMOTE_USER'       => $_SERVER['REMOTE_USER'] ?? null,
+    'AUTH_USER'         => $_SERVER['AUTH_USER'] ?? null,
+    'PHP_AUTH_USER'     => $_SERVER['PHP_AUTH_USER'] ?? null,
+    'REDIRECT_REMOTE_USER' => $_SERVER['REDIRECT_REMOTE_USER'] ?? null,
+];
+
+echo json_encode([
+    'headers' => $headers,
+    'server'  => $server,
+    'remote_addr' => $_SERVER['REMOTE_ADDR'] ?? null,
+], JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES);