fix(auth): sessions authenticate by bearer only - #2477

🟢 Confidence 10/10 · safe to merge. Both new behaviours — cookie never read by toHeaders, cookie stripped by the /_api proxy — are pinned by tests that fail on main; the only new commit adds one such test.
_{no findings · tests covered · risk high}

Sessions now authenticate by the Authorization bearer only: toHeaders forwards nothing else to Clerk, the /_api proxy drops Cookie, and MCP stops counting a cookie as a credential. Contained and safe to merge; the comment at apps/ai/src/runtime/auth-graph.ts:16 still says "session cookie".

• toHeaders forwards only the authorization header to Clerk's authenticateRequest
• /_api forwarding deletes the incoming Cookie header before the binding call
• MCP carriesCredential no longer treats a cookie as a credential
• New tests: cookie-only rejection in packages/auth and apps/ai, cookie stripped in apps/web

_{9259676 · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}