14.54Security-focused API tests

Test:

missing auth
→ 401

invalid token
→ 401

authenticated but unauthorized
→ 403

valid client
→ success

Also verify error body does not leak:

Salesforce token
client secret
internal stack trace
SOQL containing sensitive details