Copilot stream endpoint has same malformed Bearer header bug

[deepak0x]

Description

Same pattern as the chat route — request.headers.get("Authorization")?.split(" ")[1] passes undefined apiKey when the Bearer token is missing.

Steps to reproduce

1. Send a request to /api/copilot-stream-response/{streamId} with header Authorization: Bearer (no token)
2. Undefined apiKey passes into the controller

Expected behavior

Return 401 if the token is missing or empty.

Actual behavior

Undefined apiKey is forwarded without validation.

[deepak0x]

@ramnique @arkml same as #493 — happy to fix both together if that works.

[fuleinist]

Fixed in PR #504