test(runtime): align stale api-key Bearer test with core's behavior

runtime/security/api-key.ts re-exports @objectstack/core's extractApiKey, which
accepts a Bearer token carrying the `osk_` api-key prefix (for remote MCP
clients — core's own test covers this). This duplicate test in runtime predated
that behavior and asserted the old "Bearer is never an api-key" rule, so it
failed whenever runtime's tests run.

It was latent on main: turbo only runs runtime's tests when runtime or a
dependency changes, and main's recent commits didn't. This PR's
@objectstack/spec change makes spec "changed", so every spec-dependent package's
tests now run — surfacing the pre-existing failure. Align the assertion with
core + the implementation (extractApiKey is re-exported, so they must agree).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: os-zhuang

packages/runtime/src/security/api-key.test.ts

@@ -84,8 +84,13 @@ describe('extractApiKey', () => {
     expect(extractApiKey({ authorization: 'apikey osk_123' })).toBe('osk_123');
   });
 
-  it('does NOT treat Bearer tokens as API keys', () => {
-    expect(extractApiKey({ authorization: 'Bearer osk_123' })).toBeUndefined();
+  it('treats Bearer tokens as API keys only when osk_-prefixed', () => {
+    // A bare Bearer (e.g. a session token) is NOT an api-key.
+    expect(extractApiKey({ authorization: 'Bearer plain' })).toBeUndefined();
+    // A Bearer carrying the api-key prefix IS accepted (remote MCP clients) —
+    // mirrors @objectstack/core's api-key test; this stale duplicate predated
+    // that behavior. extractApiKey is re-exported from core, so they must agree.
+    expect(extractApiKey({ authorization: 'Bearer osk_123' })).toBe('osk_123');
   });
 
   it('prefers x-api-key over Authorization', () => {