test(server): pin bearer → registry resolve chain under stateful streamable-http (#703) (#736)

Adds tests/test_tier2_auth_resolution.py with three regression guards
covering the auth-pipeline chain the v3 reference seller wires:

1. ``test_subdomain_tenant_middleware_propagates_into_dispatch_task``
   asserts ``current_tenant()`` is observable inside the dispatch task
   that runs the MCP tool handler under default stateful streamable-http.
   Adopter stores (BuyerAgentRegistry, AccountStore) read this accessor
   to scope queries — a None return silently fails every resolve.

2. ``test_buyer_agent_registry_resolves_under_stateful_bearer_flow``
   end-to-end pins the four-piece chain (BearerTokenAuthMiddleware +
   SubdomainTenantMiddleware + context_factory upgrading
   ``adcp.auth_info`` to ``ApiKeyCredential`` + tenant-scoped registry)
   that the v3 reference seller wires after PR #693 added the bearer
   auth wiring to ``examples/v3_reference_seller/src/app.py``.

3. ``test_buyer_agent_registry_rejects_when_credential_upgrade_skipped``
   pins the negative contract: without the ``adcp.auth_info`` upgrade,
   the framework MUST reject with ``PERMISSION_DENIED`` (no leaked
   details) — documenting the failure mode #703 surfaced and why the
   upgrade in ``_build_context_factory`` is load-bearing.

Issue #703 surfaced when an intermediate state of PR #693 enabled the
storyboard CI assertion before the seller's bearer-auth wiring was
added (commit ``84c0c24d``, May 12). The auth wiring landed in the
squashed merge ``27a58661``; current main passes the storyboard
end-to-end. These tests pin the wired contract so a future refactor
that breaks any leg trips here rather than the storyboard CI cascade.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: bokelley