[FEATURE]: Accept bearer token via WebSocket subprotocol for browser clients #73

Browser WebSocket APIs cannot set custom headers, so browser clients such as acp-ui send Authorization: Bearer <token> as an extra bearer.<token> entry in Sec-WebSocket-Protocol, next to acp.v1.

acpremote currently reads the bearer token only from the Authorization header (is_bearer_authorized), so authenticated servers reject browser clients even now that #71 negotiates acp.v1.

Proposed scope:

• Accept the token from a bearer.<token> subprotocol entry in _process_request auth checks.
• Keep acp.v1 as the only subprotocol echoed in the response; never echo the bearer.* entry.
• Add tests for header auth, subprotocol auth, and mismatched tokens.

Follow-up to #67 / #71.