Clear the authentication and middleware quality gate

[jonbaldie]

Parent

#27 — Bring production TypeScript to messcript's idiomatic ruleset

What to build

Authentication and middleware refactoring passes the structural-quality gate while bearer-token enforcement, health-check exemptions, forwarded-client handling, middleware ordering, and rate-limit responses remain unchanged.

Acceptance criteria

• The middleware production unit reports zero selected messcript findings under the pinned policy.
• Real HTTP requests verify health access without credentials, authentication failures, authenticated access, rate limiting before authentication, and forwarded-client behavior.
• The refactor contains no source suppression or policy weakening.

Blocked by

• Pin messcript and define the production TypeScript gate #28 — Pin messcript and define the production TypeScript gate.
• Clear the rate limiter quality gate #32 — Clear the rate limiter quality gate.