fix: Authorization header passthrough for Apache CGI

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.htaccess

 RewriteEngine On
 
+# Pass Authorization header to PHP
+SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
+
 # Serve existing files/dirs directly
 RewriteCond %{REQUEST_URI} ^/public/ [OR]
 RewriteCond %{REQUEST_URI} ^/api/

includes/auth.php

@@ -3,7 +3,11 @@
 require_once __DIR__ . '/../config/constants.php';
 
 function getAuthToken(): ?string {
-    $header = $_SERVER['HTTP_AUTHORIZATION'] ?? '';
+    $header = $_SERVER['HTTP_AUTHORIZATION'] ?? $_SERVER['REDIRECT_HTTP_AUTHORIZATION'] ?? '';
+    if (empty($header) && function_exists('getallheaders')) {
+        $headers = getallheaders();
+        $header = $headers['Authorization'] ?? $headers['authorization'] ?? '';
+    }
     if (preg_match('/Bearer\s+(.+)/i', $header, $m)) {
         return $m[1];
     }