Add portal header helpers

Локально .DS_Store создавался Finder'ом и попадал в untracked.
Добавлен в .gitignore, чтобы дальше не маячил в git status.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitignore

@@ -0,0 +1,2 @@
+# macOS Finder metadata
+.DS_Store

middleware/headers.go

@@ -0,0 +1,45 @@
+package middleware
+
+import (
+	"net/http"
+	"strings"
+)
+
+// HeaderBool reads portal-proxy boolean headers.
+// Contract: "1", "true", "yes" and "on" are true; everything else is false.
+func HeaderBool(r *http.Request, name string) bool {
+	switch strings.ToLower(strings.TrimSpace(r.Header.Get(name))) {
+	case "1", "true", "yes", "on":
+		return true
+	default:
+		return false
+	}
+}
+
+// HeaderCSV returns a trimmed non-empty CSV list from a portal-proxy header.
+func HeaderCSV(r *http.Request, name string) []string {
+	raw := strings.TrimSpace(r.Header.Get(name))
+	if raw == "" {
+		return nil
+	}
+	parts := strings.Split(raw, ",")
+	out := make([]string, 0, len(parts))
+	for _, part := range parts {
+		if v := strings.TrimSpace(part); v != "" {
+			out = append(out, v)
+		}
+	}
+	return out
+}
+
+// HeaderScope returns a lower-cased scope constrained to allowed values.
+// The fallback is returned when the header is empty or unknown.
+func HeaderScope(r *http.Request, name, fallback string, allowed ...string) string {
+	value := strings.ToLower(strings.TrimSpace(r.Header.Get(name)))
+	for _, option := range allowed {
+		if value == strings.ToLower(strings.TrimSpace(option)) {
+			return value
+		}
+	}
+	return fallback
+}