Carry the validated bearer token to scope checks

[adamtheturtle]

State-based Model Target requests first validated the Authorization header, then the scope check fetched and parsed the same header again. Static analysis could not carry the earlier validation through that second lookup, so the helper used an assertion with a security-rule suppression.

Return the validated bearer token from the authentication helper and pass it directly to the state-scope check. The callers now narrow the token-or-error result, eliminating the duplicated header access and the S101 suppression while preserving all response behavior.

Validation:

• all configured pre-commit hooks
• all configured pre-push hooks (Mypy, Pyright, Pyrefly, Ty, verifytypes, docs, manifest and partition checks)
• full non-real-backend suite: 1,947 passed, 843 skipped
• changed module: 100% local coverage

The aggregate local report is the repository’s known 99% when the separately partitioned real Vuforia backend is excluded; CI combines the configured partitions and remains the authoritative 100% gate.