feat(http): implement shared Bearer auth middleware (resolve_from_token, stash Identity in request extensions)

Add src/server/auth.rs with bearer_auth_middleware axum layer that
extracts the Authorization: Bearer header, resolves via
IdentityProvider::resolve_from_token, and stashes Option<Identity> in
request extensions. Shared by HTTP gateway routes and the to_mcp rmcp
service (research §4.4). No token, malformed header, or failed
resolution all yield None (unauthenticated, not an error) — Bearer-only
auth mechanism (ADR-004).

Includes ResolvedIdentity axum extractor reading from extensions, and
wires the middleware into the HttpAdapter router around the
gateway/openapi/mcp routes (excluding the raw /healthz route).

crates/alknet-http/src/server/mod.rs

@@ -1,5 +1,5 @@
 //! HTTP server: `HttpAdapter`, axum-over-QUIC, gateway routes, `/healthz`,
-//! decoy, and custom routes.
+//! decoy, custom routes, and shared Bearer auth middleware.
 //!
 //! Implements `alknet_core::types::ProtocolHandler` for the standard HTTP
 //! ALPNs (`h2`, `http/1.1`) with WebSocket upgrade for browser
@@ -7,5 +7,7 @@
 //! `docs/architecture/crates/http/http-server.md`.
 
 pub mod adapter;
+pub mod auth;
 
-pub use adapter::{DecoyConfig, HttpAdapter};
+pub use adapter::{DecoyConfig, HttpAdapter};
+pub use auth::{bearer_auth_middleware, extract_bearer_identity, ResolvedIdentity};