Normalize key backup bearer tokens

[aiirvizionz]

Summary

• normalize auth/key-backup Bearer headers with case-insensitive scheme handling and whitespace trimming
• ignore empty Bearer headers so cookie auth can still be used
• add focused key backup auth tests for flexible Bearer parsing and empty-header fallback

Tests

• vitest run src/app/api/auth/key-backup/route.test.js
• node --check src/app/api/auth/key-backup/route.js
• node --check src/app/api/auth/key-backup/route.test.js
• git diff --check