fix: send api key on worker node registration

[kaiitunnz]

Purpose

A worker node's supervisor couldn't register with a root server when the root had any IdentityProvider plugin chain installed. Lifecycle._register_http posted to /api/v1/nodes/register without an Authorization header, so the server's auth chain rejected the unauthenticated POST. Every other supervisor / runtime path already attaches FLOWMESH_API_KEY as a bearer token — registration was the odd one out.

This PR ships the fix plus the refactor it landed on top of: the auth_headers / add_auth_headers helpers (previously buried in worker/executors/utils/artifacts.py) move to shared.utils.http so the supervisor can reuse them without depending on the executor stack. While there, drop dead duplicates from server/utils/helpers.py.

Changes

• Fix: Lifecycle._register_http now sends Authorization: Bearer ${FLOWMESH_API_KEY} on POST /api/v1/nodes/register; tests/server/test_supervisor_lifecycle.py pins the header contract for both the set / unset key cases.
• New shared.utils.http holds auth_headers and add_auth_headers. Worker call sites re-import from here; the supervisor reuses the same helpers. Module stays os-only (no aiohttp / requests) so the worker SSH executor import chain stays clean under runtime-worker-core.
• server/utils/helpers.py cleanup: drop the JSON helpers already duplicated in shared.utils.json, fold iter_pubsub_messages into clients/redis.py (keeping the safer error-tolerant variant), and drop get_logger in favor of logging.getLogger("supervisor") at the two adapter call sites.

Design

The bug fix on its own is a two-line change. The refactor isn't strictly required, but auth_headers is the only obviously-shared piece between _register_http and the rest of the runtime — leaving it under worker.executors.utils.artifacts would have left the supervisor depending on the executor module just to format a bearer header. Moving it to shared.utils.http keeps the fix readable and makes the helper available to anything else that talks to the server. The helpers.py cleanups are opportunistic — same file, same review, no extra surface.

Test Plan

uv run pre-commit run --all-files
uv run pytest tests --ignore=tests/worker/test_mp_executor_cleanup_gpu.py

No live multi-node smoke run on this branch — the fix is mechanical (header attach) and covered by the new lifecycle tests.

Test Result

$ uv run pre-commit run --files <touched files across the branch>
# All passed

$ uv run pytest tests --ignore=tests/worker/test_mp_executor_cleanup_gpu.py
# 864 passed, 18 warnings in 32.00s

---

Pre-submission Checklist

• I have read the contribution guidelines.
• I have run pre-commit run --all-files and fixed any issues.
• I have added or updated tests covering my changes (if applicable).
• I have verified that uv run pytest tests/ passes locally.
• If I changed shared schemas or proto definitions, I have checked downstream compatibility across Server and Worker.
• If I changed the SDK or CLI, I have verified the affected packages work (uv sync --all-packages --group ci --frozen).
• If this is a breaking change, I have prefixed the PR title with [BREAKING] and described migration steps above.
• I have updated documentation or config examples if user-facing behavior changed.

[timzsu]

LGTM. One potential risk posed by the broad try-except.

As this is a critical bugfix, I suggest we publish a patch release 0.1.1 after this PR.

[timzsu]

LGTM.