Tempo session close/top-up/voucher retry ignore the challenge's credential header (requiresAuth)

Start in src/tempo/session/client/Transports.ts at postManagementCredential, requestInitWithAuthorization, and closeHttpSession, then inspect the HEAD bootstrap in SessionManager.ts. Run the four tests added in PR #931 against main and trace the requiresAuth flow. Done means top-up, voucher retry, close, and bootstrap use the challenge credential header without overwriting the app's Authorization header.

Check existing issues

• I checked there isn't already an issue for the bug I encountered.

Describe the bug

With Mppx.create({ requiresAuth: true }) (added in #821), every challenge carries header="Payment-Authorization" and the server reads the credential only from that header. The core client follows it (Challenge.credentialHeader), so opening a Tempo session and ordinary vouchers work. But sessionManager's own requests hard-code Authorization:

• postManagementCredential, used by top-up (Transports.ts#L656)
• requestInitWithAuthorization, used by the 402 voucher retry (#L573)
• closeHttpSession (#L764)
• the HEAD bootstrap (SessionManager.ts#L492)

Those requests send the credential in Authorization, which the requiresAuth transport doesn't read, so the server answers 402. In the flow below, both close POSTs get 402 and close() rejects, so the channel isn't closed cooperatively. Top-up and the voucher retry hit the same 402. The voucher retry and the bootstrap also overwrite the app's own Authorization header, which requiresAuth is meant to keep free.

I'd like to submit a PR for this.

Link to Minimal Reproducible Example

https://github.com/wevm/mppx/pull/931 (its four new tests fail on main)

Steps To Reproduce

Server: Mppx.create({ requiresAuth: true, methods: [tempo.session({ unitType: 'request', ... })] }) from mppx/server. Client: sessionManager({ ... }) from mppx/client. Then call manager.fetch(url) twice and manager.close(). Requests as the server sees them:

GET  cred-in=none                  -> 402
GET  cred-in=Payment-Authorization action=open    -> 200
GET  cred-in=none                  -> 402
GET  cred-in=Payment-Authorization action=voucher -> 200
POST cred-in=Authorization         action=close   -> 402
POST cred-in=Authorization         action=close   -> 402
close() throws: Close request failed with status 402: Payment is required. [WWW-Authenticate: Payment ... header="Payment-Authorization"]

The same flow with requiresAuth: false closes normally. I ran this with the mocked chain clients from src/tempo/session/server/Session.test.ts.

Package Version

0.11.0 (reproduced on main @ 42e9b8f)

Anything else?

Node.js v26.8.2, macOS. Challenge.credentialHeader(challenge) already exists, and so does the core client's setCredentialHeader. Using them at those four places fixes it for sessionManager. The CLI's own session close (src/cli/plugins/tempo.ts, closeChannel) and the legacy v1 session manager have the same hard-coded header; I left those for a follow-up.