fix(auth): correct JWT token lookup to strip Bearer prefix

The TokenLookup config was missing the Bearer prefix stripper, causing
all authenticated requests to fail with 'token is malformed'. The JWT
library was trying to decode 'Bearer eyJh...' as a token, failing at
the space character.

Changed from: 'cookie:token,header:Authorization'
Changed to:   'cookie:token,header:Authorization:Bearer '

This fixes all integration tests that use Bearer token authentication.

internal/router/router.go

@@ -66,7 +66,7 @@ func createJWTMiddleware(cfg *Config) echo.MiddlewareFunc {
 	return echojwt.WithConfig(echojwt.Config{
 		SigningKey:  []byte(cfg.Cfg.JWTSecret),
 		ContextKey:  "user",
-		TokenLookup: "cookie:token,header:Authorization",
+		TokenLookup: "cookie:token,header:Authorization:Bearer ",
 		SuccessHandler: func(c echo.Context) {
 			token := c.Get("user").(*jwt.Token)
 			claims := token.Claims.(jwt.MapClaims)