fix: reject empty bearer tokens

[lprnmns]

Problem

An empty Bearer credential (Authorization: Bearer ) currently reaches token decoding and returns HTTP 500 with missing token. This malformed authentication input should use the existing HTTP 400 Bad Request path.

Fix

Require a non-empty token before accepting the two-part Bearer header. The existing FST_JWT_BAD_REQUEST error and message are reused.

Tests

• node --test test/malformed-authorization.test.js - passed after the fix; the pre-fix run failed with 500 !== 400
• npm test - passed; 179 unit tests, 100% coverage, and 44 TSTyche assertions
• Adjacent valid/empty Bearer runtime probe - passed; valid token remained HTTP 200 and empty token became HTTP 400
• git diff --check - passed

Compatibility

Only an empty Bearer value changes behavior. Valid Bearer tokens and the other authentication branches remain covered by the full suite.

Related issue

Independent reproduction; final searches found no matching open issue or pull request.