feat(auth): fall back to GITEA_MCP_DEFAULT_TOKEN when no Bearer header

claude.ai connectors call the server with no Authorization header (confirmed
via request logging). Add a configurable default Gitea PAT so unauthenticated
clients (like claude.ai) can still reach the server.

Claude Code continues to pass per-request PATs; defaultToken="" preserves
the existing strict behaviour when the env var is unset.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/auth/bearer_test.go

@@ -11,7 +11,7 @@ import (
 )
 
 func TestBearerMiddleware_NoAuthHeader(t *testing.T) {
-	srv := httptest.NewServer(auth.BearerMiddleware("https://gitea.example.com",
+	srv := httptest.NewServer(auth.BearerMiddleware("https://gitea.example.com", "",
 		http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 			w.WriteHeader(http.StatusOK)
 		}),
@@ -24,6 +24,32 @@ func TestBearerMiddleware_NoAuthHeader(t *testing.T) {
 	assert.Equal(t, http.StatusUnauthorized, resp.StatusCode)
 }
 
+func TestBearerMiddleware_NoAuthHeaderWithDefault(t *testing.T) {
+	const defaultToken = "default-pat"
+
+	giteaMock := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "token "+defaultToken, r.Header.Get("Authorization"))
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer giteaMock.Close()
+
+	called := false
+	srv := httptest.NewServer(auth.BearerMiddleware(giteaMock.URL, defaultToken,
+		http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			called = true
+			assert.Equal(t, defaultToken, auth.TokenFromContext(r.Context()))
+			w.WriteHeader(http.StatusOK)
+		}),
+	))
+	defer srv.Close()
+
+	resp, err := http.Post(srv.URL+"/mcp", "application/json", nil)
+	require.NoError(t, err)
+	defer func() { _ = resp.Body.Close() }()
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+	assert.True(t, called)
+}
+
 func TestBearerMiddleware_InvalidToken(t *testing.T) {
 	// Mock Gitea that rejects the token
 	giteaMock := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -31,7 +57,7 @@ func TestBearerMiddleware_InvalidToken(t *testing.T) {
 	}))
 	defer giteaMock.Close()
 
-	srv := httptest.NewServer(auth.BearerMiddleware(giteaMock.URL,
+	srv := httptest.NewServer(auth.BearerMiddleware(giteaMock.URL, "",
 		http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 			w.WriteHeader(http.StatusOK)
 		}),
@@ -57,7 +83,7 @@ func TestBearerMiddleware_ValidToken(t *testing.T) {
 	defer giteaMock.Close()
 
 	called := false
-	srv := httptest.NewServer(auth.BearerMiddleware(giteaMock.URL,
+	srv := httptest.NewServer(auth.BearerMiddleware(giteaMock.URL, "",
 		http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			called = true
 			// Token must be available in context for downstream Gitea client