fix(auth): preserve padded auth cookie values

[aiirvizionz]

The public-key auth endpoints parsed cookies with split('=') and discarded everything after the first equals sign. Supabase base64 auth cookie values can include padding, so valid sessions were rejected when padding was present.

This patch:

• preserves the complete cookie value after the first separator in both public-key endpoints
• adds focused coverage for padded base64 auth cookies to the single-key and all-keys routes
• keeps the existing authentication and service-role boundaries unchanged

Validation:

• route.test.js and all/route.test.js: 4 tests passed with Vitest 4.1.8