irule for redirect and header injection

Your iRule logic is correct for "inject header only if not redirecting." If you want the header to be present on requests that are redirected, that's not possible, redirects are handled by the client, not the backend. If you want the header on proxied requests, your iRule is correct.

Here is the irule

when HTTP_REQUEST {
    if { ([HTTP::uri] equals "/app123") or ([HTTP::host] equals "app234.mydomain") } {
        HTTP::redirect "https://your-backend-url.example.com"
        return
    }
    HTTP::header replace "X-Authenticated-User" "true"
}