fix(http): advertise bearer challenge on current main

src/main/java/com/clearfolio/viewer/controller/ArtifactHttpResponse.java

@@ -99,10 +99,13 @@ static ResponseEntity<byte[]> unsatisfiable(
      * @return controlled token failure response
      */
     static ResponseEntity<byte[]> tokenFailure(HttpStatus status) {
-        return ResponseEntity.status(status)
+        ResponseEntity.BodyBuilder builder = ResponseEntity.status(status)
                 .header(HttpHeaders.CACHE_CONTROL, "no-store")
-                .header(CONTENT_TYPE_OPTIONS, "nosniff")
-                .build();
+                .header(CONTENT_TYPE_OPTIONS, "nosniff");
+        if (status == HttpStatus.UNAUTHORIZED) {
+            builder.header(HttpHeaders.WWW_AUTHENTICATE, "Bearer");
+        }
+        return builder.build();
     }
 
     private static ResponseEntity.BodyBuilder decorateRangeHeaders(

src/test/java/com/clearfolio/viewer/controller/ArtifactHttpResponseTest.java

@@ -0,0 +1,38 @@
+package com.clearfolio.viewer.controller;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.HttpStatus;
+
+/**
+ * Regression tests for security-sensitive artifact token failure response headers.
+ */
+class ArtifactHttpResponseTest {
+
+    /**
+     * Requires a bearer challenge while preserving cache and MIME-sniffing defenses on 401.
+     */
+    @Test
+    void unauthorizedTokenFailureAdvertisesBearerChallenge() {
+        var response = ArtifactHttpResponse.tokenFailure(HttpStatus.UNAUTHORIZED);
+
+        assertEquals("Bearer", response.getHeaders().getFirst(HttpHeaders.WWW_AUTHENTICATE));
+        assertEquals("no-store", response.getHeaders().getFirst(HttpHeaders.CACHE_CONTROL));
+        assertEquals("nosniff", response.getHeaders().getFirst("X-Content-Type-Options"));
+    }
+
+    /**
+     * Keeps 403 from restarting authentication while preserving the standard security headers.
+     */
+    @Test
+    void forbiddenTokenFailureDoesNotRestartAuthentication() {
+        var response = ArtifactHttpResponse.tokenFailure(HttpStatus.FORBIDDEN);
+
+        assertNull(response.getHeaders().getFirst(HttpHeaders.WWW_AUTHENTICATE));
+        assertEquals("no-store", response.getHeaders().getFirst(HttpHeaders.CACHE_CONTROL));
+        assertEquals("nosniff", response.getHeaders().getFirst("X-Content-Type-Options"));
+    }
+}