Lifts the Bearer principal-derivation and the request→CaptureInput decode out of the REST handler into exported package funcs, so the MCP capture tool (#55 relay) reuses the exact same auth precedence and wire shape — one implementation, not two. No behaviour change to POST /capture. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>