Refactor Passthrough Token handling into reusable middleware

[cubap]

Why

The existing Passthrough Token implementation duplicated logic across routes and used a placeholder Authorization header, causing maintenance overhead and potential errors. A modular approach improves consistency and makes future extensions easier.

What was done

• Added passthrough.js providing resolveAuthorization and requirePassthroughAllowed middleware.
• Updated tokens.js to bypass token refresh when a client-supplied Authorization header is present.
• Refactored create and update routes to import the new helpers, enforce the kill‑switch before token checks, and forward the exact client Authorization header.
• Updated README with a Passthrough Token Mode section and a Mermaid diagram showing the middleware flow.
• Added test/routes/passthrough.test.js to verify header forwarding.
• Prepared groundwork for delete and overwrite routes (imports added, pending final header replacement).

Notes

• The new middleware centralizes Authorization handling and respects the ALLOW_PASSTHROUGH_TOKENS environment variable, returning 403 when disabled.
• Documentation now explains the feature and includes a visual diagram for developers.
• All changes are covered by the new unit test.

Checklist

• Code compiles
• Tests pass
• Documentation updated
• Finalize delete and overwrite routes (planned for subsequent PR)

[thehabes]

argh