fix(wrapper): make JWT optional in composite Bearer token (issue #53)

[levleontiev]

Closes #53

What changed

wrapper.parse_composite_bearer() now accepts plain upstream keys (no JWT):

Bearer token	Before	After
JWT:upstream-key	✅ accepted	✅ accepted
upstream-key (no colon)	❌ 401 composite_key_invalid	✅ accepted, jwt_part=nil
:upstream-key (empty JWT)	❌ 401	❌ 401 (unchanged)
empty token	❌ 401	❌ 401 (unchanged)

Implementation

src/fairvisor/wrapper.lua

• When no : in token → return { jwt_part=nil, upstream_key=token, claims={} }
• All other validation paths unchanged
• ngx.ctx.wrapper_tenant remains "" for anonymous callers (no JWT)

spec/unit/features/wrapper.feature

• Replaced "Missing colon separator returns composite_key_invalid" with two new scenarios:
  • "Plain upstream key without JWT succeeds" (happy path)
  • "Bearer with only a colon (empty JWT) returns composite_key_invalid" (edge case)
• Added "Plain upstream key without JWT allows request" in access_handler rule

spec/unit/wrapper_spec.lua

• Added "jwt_part is nil" step definition