Refactor HttpApi auth middleware wiring

[kitlangton]

Summary

• Move experimental HttpApi authorization middleware into a shared route-level auth module.
• Attach authorization in each HttpApi route definition instead of wrapping APIs centrally in the server composer.
• Model auth_token as an HttpApi query security scheme instead of rewriting request headers.

Testing

• bun typecheck from packages/opencode