test: cover configured HTTP bearer router auth

[shivros]

Summary

• add deterministic public-router coverage for a configured HTTP bearer token
• prove /providers rejects missing, malformed, and incorrect credentials, while accepting the configured test credential
• prove /health remains available without credentials when the token boundary is enabled

Scope

Test-only follow-up for COD-469. Authentication policy, token storage, public operations, generated artifacts, deployment behavior, and runtime configuration are unchanged.

Verification

cargo build --all-targets                                 PASS
cargo test --all-targets                                  PASS (221 tests)
cargo clippy --all-targets -- -D warnings                 PASS
cargo fmt --all -- --check                                PASS
cargo run -p iris-codegen --bin iris-codegen -- check     PASS
git diff --check                                          PASS

Review evidence

The test uses the public configured-token app constructor and Axum oneshot requests at the actual router boundary. Both independent review-panel seats approved the final diff.

[shivros]

🤖 Automated Review Panel

Reviewer A — GPT-5.6-terra

APPROVE — The change meets COD-469. It builds a nonblank-token router through the public constructor and exercises /providers via oneshot for missing, malformed, incorrect, and exact bearer credentials; it also verifies unauthenticated /health remains 200. Assertions inspect only status codes, so the configured test credential is not emitted in logs, payloads, snapshots, or docs. No correctness or regression issue found.

Reviewer B — Gemini 3 Flash

APPROVE — The test exercises the full router boundary via oneshot, including configured middleware and the /health bypass. The no-op audit fixture correctly satisfies the public constructor's trait requirements. Coverage includes missing, malformed, and incorrect tokens, while using a test-only string and status-only assertions. The change is test-only and does not modify production authentication behavior.

Runner verification

cargo build --all-targets, cargo test --all-targets (221 tests), strict Clippy, format check, codegen freshness, and git diff --check all passed.