Bun: empty Basic-auth credentials cause stack overflow instead of 401

## Summary

Sending a Basic-auth header with empty username and empty password (`Basic `) causes Harper to crash with `Maximum call stack size exceeded` under Bun instead of returning a graceful 401.

## Reproduction

Start Harper on Bun and send:

```
POST /
Authorization: Basic Og==
Content-Type: application/json

{"operation":"describe_all"}
```

## Observed

Harper throws a stack overflow and the worker becomes unresponsive:

```
{"error":"Maximum call stack size exceeded."}
```

## Expected

401 with `{"error":"Must login"}` or similar.

## Context

Discovered via integration test `describe_all with empty credentials returns 401` in `integrationTests/apiTests/authentication.test.mjs` (PR #645). The test was skipped on Bun as a workaround.

The crash only occurs on Bun. Node.js handles the same request correctly. The stack trace points into `dist/security/auth.js` — likely a recursive call triggered when both username and password are empty strings that behaves differently under Bun's string/prototype handling.

Related: #38 (Support running on Bun)