Harden admin authentication behind trusted proxy

app/config.py

@@ -1,3 +1,5 @@
+from typing import Literal
+
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
 
@@ -21,6 +23,7 @@ class Settings(BaseSettings):
     clientflow_persist: bool = True
 
     clientflow_webhook_secret: str = ""
+    clientflow_admin_auth_mode: Literal["proxy", "token", "local"] = "proxy"
     clientflow_admin_token: str = ""
 
     # UI warning for cases where the original opportunity contact and the
@@ -134,10 +137,21 @@ def is_production_like_env() -> bool:
     return str(settings.env or "").strip().lower() in {"prod", "production", "staging"}
 
 
-if is_production_like_env() and not str(settings.clientflow_admin_token or "").strip():
-    raise RuntimeError(
-        "CLIENTFLOW_ADMIN_TOKEN é obrigatório em prod/production/staging."
-    )
+def validate_admin_auth_settings() -> None:
+    if settings.clientflow_admin_auth_mode == "local" and is_production_like_env():
+        raise RuntimeError(
+            "CLIENTFLOW_ADMIN_AUTH_MODE=local não é permitido em prod/production/staging."
+        )
+    if (
+        settings.clientflow_admin_auth_mode == "token"
+        and not str(settings.clientflow_admin_token or "").strip()
+    ):
+        raise RuntimeError(
+            "CLIENTFLOW_ADMIN_TOKEN é obrigatório quando CLIENTFLOW_ADMIN_AUTH_MODE=token."
+        )
+
+
+validate_admin_auth_settings()
 
 if (
     is_production_like_env()