Merge feat/http-bearer-auth-middleware: Shared Bearer auth middleware

Implements src/server/auth.rs: bearer_auth_middleware (from_fn_with_state over
Arc<dyn IdentityProvider>, stashes Option<Identity> in request extensions),
extract_bearer_identity (Bearer-only: no/malformed/Basic/unresolvable → None,
not an error), ResolvedIdentity axum extractor. Wired into HttpAdapter router
via route_layer around gateway/openapi/mcp routes, excluding /healthz. 11 tests.

# Conflicts:
#	crates/alknet-http/Cargo.toml
#	crates/alknet-http/src/server/adapter.rs
#	crates/alknet-http/src/server/mod.rs

crates/alknet-http/src/server/mod.rs

@@ -1,5 +1,5 @@
 //! HTTP server: `HttpAdapter`, axum-over-QUIC, gateway routes, `/healthz`,
-//! decoy, and custom routes.
+//! decoy, custom routes, and shared Bearer auth middleware.
 //!
 //! Implements `alknet_core::types::ProtocolHandler` for the standard HTTP
 //! ALPNs (`h2`, `http/1.1`) with WebSocket upgrade for browser
@@ -7,9 +7,11 @@
 //! `docs/architecture/crates/http/http-server.md`.
 
 pub mod adapter;
+pub mod auth;
 pub mod decoy;
 pub mod healthz;
 
 pub use adapter::{DecoyConfig, HttpAdapter};
+pub use auth::{bearer_auth_middleware, extract_bearer_identity, ResolvedIdentity};
 pub use decoy::decoy_fallback;
-pub use healthz::healthz;
+pub use healthz::healthz;