Authelia can operate at the proxy level as you said, but it can also work at the application level. Authelia implements the OpenIDConnect standard which is designed first as a way for applications to authenticate users using client side redirects.

My recommendation would be to build (or potentially find) a piece of middleware that performs your API/DB query and then redirects to Authelia based on the response. Depending on what proxy/LB you're using it might even support this natively

Can you not just send the users request to two different URL, based on the decision if it needs auth or not? That would not be authelias task but your internal url routers. Authelia would handle the authentication on the path that requires auth and your proxy would directly serve the "open" content. The logic would have to take place in your app.

myapp.org/ checks what it's going to be

myapp.org/secret/ serves content you need to be authenticated for

myapp.ort/open/ serves content that doesn't need auth.