Normalize API bearer token parsing

[aiirvizionz]

Summary

• normalize API bearer token parsing so bearer, Bearer, and extra spaces all use the supplied token
• keep cookie fallback for missing or empty bearer values
• add focused Vitest coverage for token parsing and fallback behavior

Validation

• vitest run src/lib/api/middleware/auth.test.js