harden: strict Bearer-only, sampled deprecation, CORS fix, tests

f30c099

Running

cduss Claude Opus 4.6 (1M context) commited on Apr 22