dream: auth — pure-SX base64 + HTTP Basic + Bearer-token middleware + 23 tests

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/dream-on-sx.md

@@ -130,6 +130,12 @@ with extensions + hardening below.
   `dream-serve`/`dream-serve-port`. `lib/dream/README.md` documents the full public
   surface, quickstart, the dependency-injection testing story, and caveats. **All
   planned extensions complete — 367/367 across 14 suites.**
+- **2026-06-07 — Ext: auth** (`lib/dream/auth.sx`, 23 tests, 390 total). Pure-SX base64
+  codec (`dream-base64-encode`/`-decode`, arithmetic via `quotient`/`mod` — no bitwise),
+  verified against RFC vectors (Man/Ma/M padding). `dream-basic-auth realm check` →
+  401 + `WWW-Authenticate: Basic realm=…`, attaches `:dream-user` on success;
+  `dream-basic-credentials` / `dream-authorization` accessors. `dream-require-bearer
+  check` → attaches `:dream-principal` or 401; `dream-bearer-token` accessor.
 
 ## Extensions (post-roadmap)
 
@@ -144,6 +150,7 @@ The five-types core is complete; these harden it toward a production HTTP front
 - [x] **JSON helpers** (encode + recursive-descent parse, pure SX).
 - [x] **Query/header convenience** (`dream-queries`, `*-or` defaults, `dream-accepts?`).
 - [x] **`api.sx` facade + README** — `dream-make-app` / `dream-serve` + `README.md`.
+- [x] **Auth** — base64 (pure SX), HTTP Basic auth + Bearer-token middleware.
 
 ## Stdlib additions Dream will need