fix(api): harden auth header parsing for proxy edge cases

[gregagi]

Summary

• triaged the reported proxy auth test / hook-proxy alert against clawrn
• could not reproduce a failure through normal API auth flows (existing API test suite passes)
• identified one defensive gap: _get_api_key_from_headers could raise on malformed non-string header values (possible with atypical proxy/header adapters)
• hardened header parsing to safely ignore invalid header types and empty values
• added regression tests for malformed headers and missing header container

Changes

• apps/api/utils.py
  • added safe header value coercion
  • added case-insensitive fallback for plain dict-like headers
  • guarded against missing request.headers
• apps/api/test_utils.py
  • new tests covering:
    • standard X-API-Key and Authorization: Bearer behavior
    • non-string Authorization values
    • non-string X-API-Key fallback behavior
    • missing headers attribute

Verification

• ENVIRONMENT=test SECRET_KEY=test DEBUG=1 SITE_URL=http://testserver DJANGO_SETTINGS_MODULE=agent_commons.settings_test uv run pytest apps/api/test_utils.py apps/api/tests.py -q
• uv run ruff check apps/api/utils.py apps/api/test_utils.py

Notes

• Sentry payload links were placeholders (example.com), so event-level reproduction was not possible.
• This patch is a low-risk hardening fix to prevent auth parser crashes from malformed proxy-forwarded headers.