feat(basic-auth): publish authenticated identity

[nerdalert]

Summary

Basic Auth currently verifies credentials but discards the verified username before later filters run. This change publishes that username through Praxis's existing private, request-local AuthenticatedIdentity extension after successful authentication.

That gives downstream filters a trusted subject without forwarding a password, retaining the Authorization header, or accepting a caller-controlled identity header.

Why this matters

The immediate use case is subject-keyed distributed token quota in Praxis AI. Multiple gateway replicas can enforce one shared quota for the same authenticated application, while different applications receive independent quotas.

The contract is intentionally authentication-method-neutral. Policy/JWT authentication already uses AuthenticatedIdentity, so downstream consumers can use one identity interface for Basic Auth now and JWT/OIDC/OAuth-backed authentication as those integrations evolve.

Behavior

• Publishes identity only after credential verification succeeds.
• Uses the verified Basic Auth username as the subject ID.
• Never stores the password or Authorization value in identity metadata.
• Leaves rejected and malformed requests without an authenticated identity.
• Preserves existing strip_authorization behavior.
• Makes the existing internal identity constructor available when the Basic Auth feature is enabled.

Tests

Adds focused coverage proving:

• a successful request publishes the expected subject;
• rejected credentials publish no identity;
• stripped Authorization behavior remains intact;
• no password is exposed through the identity object.

Static and focused validation was completed before the commit.

Closes #1107.
Related to praxis-proxy/ai#121 and praxis-proxy/grid#101.

Related implementation

• AI subject-keyed token quota: feat(token-rate-limit): key quotas by authenticated subject ai#980
• Grid three-application qualification: test(quota): qualify three-application distributed quotas grid#127
• Runnable demo: Add Grid distributed quota demo demos#20