[Subtask] test(mcp-server): unit tests for auth flow and audit behaviour

### Describe the subtask

Add unit tests covering the authentication flow and audit logging introduced in the preceding subtasks.

**Changes:**
- New `tests/unit/test_auth_flow.py`: verify token is injected into httpx headers; verify missing token raises when required; verify anonymous fallback when token is empty
- New `tests/unit/test_audit.py`: verify `AuditLogger` writes correct JSON; verify `AuditMiddleware` records `allow` on success and `deny` on `GravitinoException` with auth error

**Acceptance:**
- `uv run pytest tests/unit/` passes with all new tests green

### Parent issue

TBD (EPIC to be linked after creation)

Start by reading the existing MCP server authentication and audit implementations, then inspect tests/unit/ for conventions. Add tests/unit/test_auth_flow.py and tests/unit/test_audit.py for the listed token, fallback, JSON, allow, and deny behaviours. Run uv run pytest tests/unit/; done means all new tests pass with the unit suite.

Written by the indexing model from the issue text.