fix(server): scope auth upstream CA to HTTP provider

[abhinav-galileo]

Summary

• add AGENT_CONTROL_AUTH_UPSTREAM_CA_FILE for http_upstream auth
• build an upstream-specific SSLContext instead of relying on process-wide SSL_CERT_FILE
• cover provider and env wiring behavior in auth framework tests

Testing

• uv run --package agent-control-server pytest server/tests/test_auth_framework.py -q
• uv run --package agent-control-server ruff check --config pyproject.toml server/src/agent_control_server/auth_framework server/tests/test_auth_framework.py
• uv run --package agent-control-server mypy --config-file pyproject.toml server/src/agent_control_server/auth_framework
• pre-push hook ran make lint and make typecheck

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!