test: cover HttpApi authorization middleware

[kitlangton]

Summary

• Add a focused Effect HttpApi test for the authorization middleware using a tiny protected route.
• Cover auth disabled, basic auth password checks, custom username, auth_token query credentials, and malformed token rejection.

Tests

• bunx prettier --write packages/opencode/test/server/httpapi-authorization.test.ts
• bunx oxlint packages/opencode/test/server/httpapi-authorization.test.ts
• bun typecheck from packages/opencode
• bun run test -- test/server/httpapi-authorization.test.ts
• bun run test -- test/server/httpapi-authorization.test.ts test/server/httpapi-instance-context.test.ts test/server/httpapi-workspace-routing.test.ts test/server/workspace-proxy.test.ts
• push hook: bun turbo typecheck