- 6 auth middleware tests: missing header, malformed Bearer, invalid JWT, wrong secret, expired token, valid token passthrough - 4 WebSocket token validation tests: valid token, invalid token, wrong secret, expired token - Web-gateway now has 36 tests (up from 26) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>