Add JWT middleware edge-case tests

[amirHdev]

Summary

Add more focused tests around JWT middleware edge cases such as expired tokens, malformed bearer tokens, invalid API keys, and optional-auth flows.

Why this matters

Authentication code is security-sensitive, and the remaining untested branches are small enough to be a good first contribution.

Suggested files

• internal/auth/auth.go
• internal/auth/auth_test.go

Acceptance criteria

• Tests cover at least expired token handling.
• Tests cover at least one malformed bearer-token case.
• Tests cover invalid API-key handling.
• go test ./... passes.

Nice to have

• Use table-driven tests so future auth cases are easy to extend.