event-ledger returns 403 instead of 401 for requests with no Authorization header

Problem

Write endpoints (/v1/ledger/.../instances/{id}, /v2/ledger/.../instances/{id},
/v3/ledger/cloudevents) return 403 when a request has no Authorization header,
instead of 401.

newPolicyMiddleware (internal/middleware/policy.go, ~line 217) forwards the
request to the policy evaluator with an empty API key even when no header was
sent. The evaluator denies it and returns 403, which gets relayed as-is.

No credentials at all should be 401, not 403. This also wastes a network call
to the evaluator on every unauthenticated request.

Fix

Return 401 immediately when Authorization is missing, unless JWT claims are
already in request context (managed-mode JWT-then-policy chain clears the
header after local verification, so that path must not be affected).

Read endpoints may rely on PDP-decided anonymous access; don't remove that.

Start in internal/middleware/policy.go at newPolicyMiddleware around line 217 and trace how the Authorization header and JWT claims in request context are handled. Verify that write endpoints return 401 without credentials before calling the policy evaluator, while managed-mode JWT requests still proceed and read endpoints retain PDP-decided anonymous access.