feat(http): implement shared Bearer auth middleware (resolve_from_token, stash Identity in request extensions)

Add src/server/auth.rs with bearer_auth_middleware axum layer that
extracts the Authorization: Bearer header, resolves via
IdentityProvider::resolve_from_token, and stashes Option<Identity> in
request extensions. Shared by HTTP gateway routes and the to_mcp rmcp
service (research §4.4). No token, malformed header, or failed
resolution all yield None (unauthenticated, not an error) — Bearer-only
auth mechanism (ADR-004).

Includes ResolvedIdentity axum extractor reading from extensions, and
wires the middleware into the HttpAdapter router around the
gateway/openapi/mcp routes (excluding the raw /healthz route).

crates/alknet-http/src/lib.rs

@@ -13,4 +13,6 @@ pub mod server;
 pub mod websocket;
 
 pub use gateway::GatewayDispatch;
-pub use server::{DecoyConfig, HttpAdapter};
+pub use server::{
+    bearer_auth_middleware, extract_bearer_identity, DecoyConfig, HttpAdapter, ResolvedIdentity,
+};