Normalize avatar bearer token parsing

[aiirvizionz]

Summary

• normalize the upload-avatar bearer token parser so case-insensitive schemes and extra spaces still validate the supplied token
• keep empty bearer headers from calling Supabase token validation
• add focused regression coverage for POST/DELETE auth behavior

Validation

• vitest run src/app/api/auth/upload-avatar/route.test.js