### Check for existing issues

- [x] I have searched the existing issues and checked that my issue is not a duplicate.

### What happened?

The header-forwarding docs (https://docs.litellm.ai/docs/proxy/forward_client_headers) make two guarantees:

1. > "The proxy's `Authorization` header (used for proxy authentication) is **never** forwarded to LLM providers, even with this setting enabled." 2. > "Headers prefixed with `x-pass-` are always forwarded with the prefix stripped, regardless of settings."

Neither holds for a generic `pass_through_endpoints` entry with `forward_headers: true`. On that route LiteLLM performs a **raw, verbatim header relay**:

- The proxy `Authorization` header — which carries the **LiteLLM master/virtual key** — is forwarded **verbatim to the upstream provider** (contradicts guarantee #1, and leaks the proxy credential to the third-party LLM API). - An `x-pass-authorization` header arrives at the upstream **unchanged** (`x-pass-authorization`), i.e. the prefix is **not** stripped and it is not rewritten to `authorization` (contradicts guarantee #2).

The `x-pass-` prefix-stripping and the "Authorization is never forwarded" rule appear to apply only to th…