Introduce authentication framework with AuthConfig, AuthGate, and Authenticator classes, alongside comprehensive tests for rules, modes, and schemes.

src/test/java/dev/coph/nextusweb/server/router/RequestTest.java

@@ -1,5 +1,6 @@
 package dev.coph.nextusweb.server.router;
 
+import dev.coph.nextusweb.server.auth.Principal;
 import dev.coph.nextusweb.server.router.exception.BadRequestException;
 import io.netty.buffer.Unpooled;
 import io.netty.handler.codec.http.DefaultFullHttpRequest;
@@ -101,4 +102,48 @@ class RequestTest {
         Request req = new Request(build(HttpMethod.POST, "/", "not-json"), Map.of());
         assertThrows(BadRequestException.class, () -> req.jsonAs(Payload.class));
     }
+
+    @Test
+    void cookieParsesNamedCookie() {
+        FullHttpRequest raw = build(HttpMethod.GET, "/", null);
+        raw.headers().set("Cookie", "sid=abc123; theme=dark");
+        Request req = new Request(raw, Map.of());
+        assertEquals("abc123", req.cookie("sid"));
+        assertEquals("dark", req.cookie("theme"));
+        assertNull(req.cookie("missing"));
+    }
+
+    @Test
+    void cookieReturnsNullWhenNoCookieHeader() {
+        Request req = new Request(build(HttpMethod.GET, "/", null), Map.of());
+        assertNull(req.cookie("sid"));
+    }
+
+    @Test
+    void attributesSetGetAndRemove() {
+        Request req = new Request(build(HttpMethod.GET, "/", null), Map.of());
+        assertNull(req.attribute("k"));
+        req.attribute("k", "v");
+        assertEquals("v", req.<String>attribute("k"));
+        req.attribute("k", null);
+        assertNull(req.attribute("k"));
+    }
+
+    @Test
+    void clientIpRoundTrips() {
+        Request req = new Request(build(HttpMethod.GET, "/", null), Map.of());
+        assertNull(req.clientIp());
+        req.clientIp("203.0.113.9");
+        assertEquals("203.0.113.9", req.clientIp());
+    }
+
+    @Test
+    void principalRoundTripsAndDrivesIsAuthenticated() {
+        Request req = new Request(build(HttpMethod.GET, "/", null), Map.of());
+        assertFalse(req.isAuthenticated());
+        assertNull(req.principal());
+        req.principal(Principal.of("user-7"));
+        assertTrue(req.isAuthenticated());
+        assertEquals("user-7", req.principal().id());
+    }
 }