feat(header_filter): strip upstream auth headers from wrapper responses (issue #42)

[levleontiev]

Summary

• src/fairvisor/wrapper.lua: adds strip_response_auth_headers() — removes Authorization, x-api-key, x-goog-api-key (both lowercase and capitalized variants) from upstream response headers before they reach the client
• src/nginx/header_filter.lua: at the top, checks ngx.ctx.wrapper_provider; if set, calls strip_response_auth_headers() and returns early — does not affect the existing reverse_proxy path
• spec/unit/features/wrapper.feature + spec/unit/wrapper_spec.lua: BDD scenario verifying all 3 auth headers are nil and Content-Type is preserved after stripping

Closes #42

Test plan

• 35 BDD unit scenarios pass (busted spec/unit/wrapper_spec.lua)
• Full suite: 582 unit + 65 integration successes
• e2e: 44 passed
• CI checks

🤖 Implemented by codex, PR opened by Claude Code