Normalize profile update bearer tokens

[aiirvizionz]

Summary

• normalize profile update Bearer headers with case-insensitive scheme handling and whitespace trimming
• reject empty Bearer headers before creating a Supabase client
• add focused profile update auth tests for normalized and empty authorization headers

Tests

• vitest run src/app/api/profile/update/route.test.js
• node --check src/app/api/profile/update/route.js
• node --check src/app/api/profile/update/route.test.js
• git diff --check