feat(auth): export Fingerprint for servers with their own accepted path

gitea-mcp's PAT pass-through authenticates ahead of BearerMiddleware and emits
its own `mcp auth accepted` line (gitea-mcp#60). It needs the same fingerprint,
not an equivalent one: two different fingerprints for the same token across two
log lines cannot be correlated, which is the entire purpose of the field.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

auth/bearer.go

@@ -176,6 +176,15 @@ func tokenType(raw string) string {
 	}
 }
 
+// Fingerprint is the exported form, for servers that authenticate on a path this
+// middleware does not own — gitea-mcp's PAT pass-through, which runs ahead of
+// BearerMiddleware and emits its own `mcp auth accepted` line.
+//
+// Exported rather than reimplemented per consumer: two different fingerprints
+// for the same token across two log lines cannot be correlated, which is the
+// entire purpose of the field.
+func Fingerprint(raw string) string { return fingerprint(raw) }
+
 // fingerprint is a short, non-reversible correlator (truncated SHA-256) so ops
 // can group repeated attempts from one client without ever logging token bytes.
 func fingerprint(raw string) string {