Adds src/httpware/_internal/auth.py with:
- AuthValue: TypeAlias = str | Callable[[], str | Awaitable[str]] | Middleware | None
- _normalize_auth(value): coerces into Middleware | None via signature-arity
  dispatch (0 → token provider, 2 → Middleware passthrough, else TypeError)
- _bearer(token): static bearer middleware via @before_request
- _bearer_from_provider(provider): dynamic bearer middleware via @before_request
  with sync/async detection via inspect.isawaitable
- _has_authorization(request): case-insensitive skip-check

Ten tests cover: None passthrough, string→bearer happy path and
skip-if-present, sync and async callable providers, callable skip-if-present,
provider called per request (no caching), Middleware identity passthrough,
1-arg callable raises TypeError, non-callable raises TypeError.

No __all__ (project convention). 100% line coverage on the new module.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…middleware/_auth

Adds the `auth: AuthValue = None` keyword param. Coerces via
_normalize_auth and appends the resulting middleware (if any) at the END
of the user-supplied middleware list — so it runs just before the
transport.

Introduces two new private attrs on AsyncClient:
- _user_middleware: the user's tuple, EXCLUDING the auth middleware
- _auth: the raw AuthValue (so with_options can recompose)

ClientConfig.middleware continues to hold the COMPOSED list (what
actually runs), keeping the existing wiring contract.

Three new construction tests verify: no auth → empty composed; string
auth → 1-element composed; user middleware + auth → 3-element composed
with user entries at positions 0,1 and auth at position 2.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Three tests confirm the auth middleware fires through the full
AsyncClient → transport path:
- string auth attaches Authorization: Bearer <token> on the transport's
  observed request
- per-call headers={"Authorization": ...} wins over the auth= param
  (skip-if-present rule)
- callable auth invokes the provider once per AsyncClient.get(...) call

No production code changes; Task 2 wired the integration.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…are/auth

with_options now accepts `auth: AuthValue | object = _UNSET`. View
construction recomposes the chain from the new (or inherited) user
middleware + auth value: `with_options(middleware=...)` preserves auth;
`with_options(auth=...)` preserves user middleware; both can change
together; neither change loses the auth/middleware that wasn't passed.

_from_view gains `user_middleware=` and `auth=` keyword params so the
view client inherits the raw inputs (not just the composed result) and
its own with_options call works correctly.

Three new wiring tests cover: auth runs INSIDE user middleware (user
sees request before auth header; transport sees it after); with_options
replaces auth in the view while preserving the parent; with_options
replacing middleware preserves auth.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Consumers writing thin wrappers around AsyncClient construction need to
type-annotate their own `auth=` parameter; without a public symbol the
only options are duplicating the union or importing from `_internal`.
Re-export `AuthValue` from `httpware._internal.auth` and add it to
`__all__`. `_normalize_auth` stays internal.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

CI ruff format check flagged 4 files where the implementer subagents
ran ruff check but not ruff format. Apply the formatter.

ty also caught test_one_arg_callable_raises_typeerror — passing a
1-arg lambda is the whole point of the test, so the existing noqa
gets paired with ty: ignore[invalid-argument-type].

Also commits the Story 2-4 plan + the spec tweak that clarified the
__all__ ordering rule (the previous wording compared 'A' < 'A' which
was incoherent).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>