Auth for self-hosted apps: Basic Auth vs forward-auth vs OIDC (plus a decision table)

When Basic Auth is enough, when forward-auth is better, and when OIDC is worth the complexity — summarized in one table