Normalize invite bearer token parsing

[aiirvizionz]

Summary

• normalize invite-anon bearer parsing so case-insensitive schemes and extra spaces still validate the intended token
• reject empty bearer headers before Supabase token validation
• add focused GET /api/auth/invite-anon regression coverage

Validation

• vitest run src/app/api/auth/invite-anon/route.test.js