(janitor/dedupe): Consolidate Authorization: Bearer token extraction

[pandemicsyn]

Summary

extractBearerToken (parse Authorization: Bearer <token>) was independently reimplemented in five places instead of using the existing @kilocode/worker-utils helper:

• services/db-proxy/src/utils/auth.ts — already drifted: case-sensitive 'Bearer ' match (no lowercase support) and returned '' instead of null for an empty token.
• apps/web/src/lib/mcp-gateway/http.ts
• apps/web/src/app/api/internal/auto-routing-benchmark/decider-candidates/route.ts
• apps/web/src/app/api/internal/auto-routing-benchmark/token/route.ts — explicitly avoided importing @kilocode/worker-utils because the root export pulls in jose, which broke under Jest's CJS transform.

All five represent the same domain concept (RFC 6750 §2.1 bearer-token parsing) and are the kind of security-relevant logic that should have one owner — the db-proxy drift is a concrete example of behavior silently diverging.

Change

• Added a dependency-free subpath export, @kilocode/worker-utils/extract-bearer-token, for the existing zero-import extract-bearer-token.ts, following the same pattern already used for ./kilo-model-id etc. so consumers don't need to pull in the package's jose dependency.
• Updated all five call sites to delegate to the shared implementation, removing the local reimplementations (including the now-unnecessary "kept local to avoid importing worker-utils" workaround in token/route.ts).
• Fixed the db-proxy test expectations to match the corrected (case-insensitive, null-for-empty) behavior, and added a case-insensitivity regression test.

Verification

• services/db-proxy: npx jest — 35/35 passing.
• packages/worker-utils: npx vitest run — 355/355 passing.
• services/db-proxy, packages/worker-utils: npx tsgo --noEmit — clean.
• oxfmt --list-different on all changed files — clean.
• Full apps/web typecheck/test run was not completed in this environment (no local Postgres available for the Jest DB fixtures, and the whole-repo tsgo run exceeded the sandbox time budget); the two changed apps/web route files and lib/mcp-gateway/http.ts are simple, type-equivalent delegations to the same shared function signature (string | null | undefined -> string | null).

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (6 files)

• apps/web/src/app/api/internal/auto-routing-benchmark/decider-candidates/route.ts
• apps/web/src/app/api/internal/auto-routing-benchmark/token/route.ts
• apps/web/src/lib/mcp-gateway/http.ts
• packages/worker-utils/package.json
• services/db-proxy/src/utils/auth.test.ts
• services/db-proxy/src/utils/auth.ts

---

_{Reviewed by grok-4.6 · Input: 67.3K · Output: 9.3K · Cached: 377.5K}

_{Review guidance: REVIEW.md from base branch main}