feat(#476): unify callback auth — headers replace body/query

[mindfn]

Summary

• Introduces registerCallbackAuthHook preHandler middleware that reads X-Invocation-Id / X-Callback-Token headers, verifies via InvocationRegistry.verify(), and decorates request.callbackAuth
• Fail-closed (fix(scheduler): infer deliveryThreadId from callback auth zts212653/clowder-ai#474): headers present + invalid → immediate 401 from preHandler; no headers → no-op (panel path)
• Migrates 30+ callback route handlers and schedule routes from inline body/query auth extraction to requireCallbackAuth(request, reply)
• Updates MCP server callbackPost / callbackGet to send credentials as HTTP headers instead of in body/query
• Deletes callbackAuthSchema (Zod schema for body validation — no longer needed)
• Net reduction of ~120 lines across 48 files

Test plan

• New callback-auth-prehandler.test.js — unit tests for valid/invalid/missing/partial headers
• Updated 26 test files (~250 individual changes) to send auth as headers: { 'x-invocation-id': ..., 'x-callback-token': ... }
• Sub-route tests add explicit registerCallbackAuthHook since they bypass the parent plugin
• Status code updates: 400→401 for missing auth, 403→401 for invalid auth
• Schedule route tests: invalid creds now rejected by preHandler (not dead INVALID_CALLBACK_CREDENTIALS code)
• MCP server callback-tools tests updated to assert headers instead of body/query
• pnpm check passes (Biome)
• pnpm lint passes (TypeScript)
• api: 7841 pass / 17 fail (all pre-existing — Redis isolation, pack validation)
• mcp-server: 72 pass / 1 fail (pre-existing — duplicate collab tools in expected list)

Closes zts212653#476
Supersedes #2 (closed due to stale base)

🤖 Generated with Claude Code