Bearer Token Value Logged to Standard Output

## Issue: FINDING-038 - Bearer Token Value Logged to Standard Output

**Labels:** bug, security, priority:high, asvs-level:L1

**ASVS Level(s):** [L1]

**Description:**

### Summary
The ASFQuart session handler contains a debug print statement that outputs the full Bearer token value to stdout when no token_handler is registered. This constitutes a direct violation of ASVS 7.2.2's requirement to avoid storing sensitive session tokens in logs. The vulnerable code prints the raw token value from Authorization: Bearer header to stdout, which persists in server log files, enabling potential replay attacks if logs are accessed. However, this is currently a dead code path as ATR registers JWT verification as the token handler in production, so the else branch is never executed.

### Details
**Affected Files and Lines:**
- `src/asfquart/session.py:73` - Debug print with token value
- `src/asfquart/session.py:88` - Debug print with token value

This appears to be debug code that was never removed. While currently unreachable in production, it represents a latent vulnerability.

### Recommended Remediation
Remove token value from log statement:

```python
# Replace:
print(f"Bearer {bearer}")

# With:
log.warning('Bearer token presented but no handler registered')
```

**Alternative:** Register a no-op token handler during application setup to prevent the debug path from executing:

```python
# In atr/server.py after app = ASFQuart(__name__)
async def _noop_token_handler(token: str):
return None

app.token_handler = _noop_token_handler
```

### Acceptance Criteria
- [ ] Token value removed from log statement
- [ ] Warning logged without token value
- [ ] No-op handler considered
- [ ] Debug code path eliminated
- [ ] Unit test verifying the fix

### References
- Source reports: L1:7.2.1.md, L1:7.2.2.md
- Related findings: None
- ASVS sections: 7.2.1, 7.2.2

### Priority
High