fix(web): require authentication for AskGH Ask APIs

[msukkari]

Require authentication for streaming and blocking Ask requests when EXPERIMENT_ASK_GH_ENABLED=true, returning HTTP 401 before entitlement checks or generation. The blocking gate lives in askCodebase, covering MCP callers too; existing anonymous access behavior is preserved when AskGH is disabled.

Verified with eight endpoint regression cases covering authenticated/anonymous requests with AskGH enabled/disabled, plus targeted ESLint.

---

Summary by cubic

When EXPERIMENT_ASK_GH_ENABLED is enabled, streaming and blocking Ask requests now require authentication and return HTTP 401 before entitlement checks or generation.

• Gates the blocking path in askCodebase, which also covers the MCP ask_codebase tool and the /api/chat/blocking route.
• Preserves anonymous access when AskGH is disabled.
• Adds regression tests for both endpoints covering authenticated and anonymous requests with the flag on and off.

^{Written for commit 690d684. Summary will update on new commits.}

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}

[msukkari]

Closing in favor of the Cursor cloud agent PR #1679 for SOU-2308.