feat(sep10-auth): extract parseBearerToken from the Express middleware (closes #38)

[dchaudhari7177]

Closes #38.

The scheme/token split was hand-rolled inside createSep10Middleware, so a Fastify or Koa adapter would have had to duplicate it. Now an exported parseBearerToken(header) in sep10-auth/src/bearer.ts, re-exported from the package index.

parseBearerToken('Bearer abc123'); // 'abc123'
parseBearerToken('Basic abc123');  // null
parseBearerToken(undefined);       // null

It accepts undefined/null so callers need no ?? '' pre-check — which is why the middleware now passes req.header('Authorization') straight in.

Behaviour preserved exactly, quirks included

This is an extraction, not a fix, so I kept the existing semantics and documented them rather than quietly improving them:

• Scheme matching stays case-sensitive — bearer abc is rejected. RFC 7235 makes auth schemes case-insensitive, so relaxing this would be a real improvement, but it widens what authenticates and that is a security-relevant decision, not something to fold into a refactor. Happy to do it as a follow-up if you want it.
• Bearer x (doubled separator) still reads as an empty token and is rejected.
• Trailing segments after the token are still ignored.

⚠️ I could not run the tests — npm ci is broken on main

Worth raising on its own: CI on main has been failing since 2026-07-30, and it is not related to this PR.

npm error code EUNSUPPORTEDPROTOCOL
npm error Unsupported URL Type "workspace:": workspace:*

e2e-tests/package.json declares "horizon-listener": "workspace:*" and "sanctions-oracle": "workspace:*", and e2e-tests is listed in the root workspaces array. The workspace: protocol is a pnpm/yarn feature that npm does not support, so npm ci and npm install both fail on a clean checkout — which also means CONTRIBUTING's documented npm install && npm test setup doesn't work today. (Reproduced locally on npm 11.13.0, and it is the exact error in the last CI run on main.) The fix is probably "*" or "^x.y.z" in e2e-tests/package.json; happy to send that as a separate PR if useful — it would unblock every other PR in the queue.

So: I have not executed sep10-auth/test/bearer.test.ts. I'm not going to claim otherwise. What I did instead was verify the extraction is behaviourally identical to the code it replaces, by running both the old inline split and the new helper over 17 inputs in plain node:

'Bearer abc123', 'Basic abc123', '', 'Bearer', 'Bearer ', undefined, null, 'abc123', 'bearer abc123', 'BEARER abc123', 'Bearer abc123', 'Bearer abc123 trailing', a real base64 XDR, ' Bearer abc', 'Bearer\tabc', 'Bearer null', 'Bearer 0'

→ identical result on all 17, so the middleware's observable behaviour is unchanged.

The 9 added jest cases cover the same ground and should pass once npm ci works again.

🤖 Generated with Claude Code