fix(claude): enforce Messages request headers

[rexdotsh]

Summary

• Set the Claude Messages anthropic-version, accept, and content-type headers authoritatively on each request (including the one-time auth replay). Claude Code 2.1.280's embedded Anthropic SDK uses 2023-06-01 and Accept: application/json even when the request body asks for streaming SSE.
• Remove caller-supplied API-key, cookie, proxy-auth, host, length, and body-encoding headers before forwarding the rewritten JSON body.
• Cover caller header overrides and streaming request headers with contract tests.

Scoped to the request-header portion of #37. The model/feature-specific beta policy is tracked separately there.

Validation

• bun test (146 passed)
• bun typecheck
• bun lint
• bun run build

No live OAuth request or production deployment was made.

[rexdotsh]

Superseded: the requested scope is the full Claude Messages request/stream alignment. I split off headers in error; replacing this with one comprehensive PR.