feat(proxy): reject unauthenticated requests with 403

[p2pdkivenko]

Summary

• Return 403 Forbidden immediately when requests lack an Authorization header
• Prevents unnecessary fan-out to upstream projects for unauthenticated clients
• Previously unauthenticated requests would fan-out, get 401 from all projects, and return a misleading 404 MANIFEST_UNKNOWN

[p2pdkivenko]

Superseded by #10 which includes both the 403 guard and service auth for upstream requests.