Normalize backup PIN bearer tokens

[aiirvizionz]

Summary

• normalize backup PIN Authorization bearer parsing with case-insensitive scheme and flexible spacing
• trim extracted bearer tokens before Supabase auth lookup
• add regression tests for spaced/case-insensitive bearer headers and empty bearer fallback

Tests

• .\node_modules.bin\vitest.CMD run src\app\api\auth\backup-pin\route.test.js
• node --check src\app\api\auth\backup-pin\route.js
• node --check src\app\api\auth\backup-pin\route.test.js
• git diff --check