fix: restore bodyless authenticated reader requests

[ty-everett]

Authenticated reader GET requests were rejected with ERR_AUTH_MALFORMED because Express 4/body-parser represents an absent body as {}. Pin the published auth middleware 2.2.6, which preserves the original bodyless BRC104 encoding while retaining strict framed-body validation. No wallet/client API migration or payment-policy change is required.

Adds an auth-only Express 4 + real SDK regression: it failed with HTTP400 on 2.2.5 and passes on 2.2.6. Local validation: all34 tests, lint, client/server typecheck, production build and production audit (zero vulnerabilities) pass. Registry tarball integrity and source provenance independently match protected Stack release35978208735. CI and runtime image scan must pass before merge; production follows the existing guarded source-owned deployment.

[ty-everett]

Authoring maintainer review of d1747a3: approve integration. This is a self-review, not an independent review. The complete diff changes only the verified auth middleware pin/integrity and adds the real SDK + Express 4 bodyless-reader regression. The test failed on 2.2.5 and passes on 2.2.6; all 34 tests, lint, typecheck, production build and production audit pass. Exact-head validation35980684319 and runtime image security35980684304 passed; no open review threads. Wire format, payment policy and client APIs are unchanged. Production entry availability/control-plane gates and actual-page probes pass; the existing guarded source-owned workflow will deploy, followed by live validation.