BOLT-1322 [sync-2/N]: widen OR-auth (admin OR supergraph triple) to ALL /v1 endpoints on OEM adapter

Sergey directive 2026-06-19T06:39Z+06:41Z (BOLT-1322 thread): 'please validate both credentials admin and supergraph on all /v1 endpoints' clarified to 'either admin OR supergraph auth should work'. PR #12557 implemented this only on /v1/commands sub-router. This task widens it. In-scope: - adapters/oem/src/routers/v1.ts: replace `v1Router.use(validateAPIKey)` with `v1Router.use(validateApiKeyOrSupergraphCredentials)` so it covers /v1/alert + manufacturer /v1/*/health endpoints. - Remove the now-redundant per-sub-router auth on /v1/commands (the global middleware will cover it). Keep /webhook routing where it is (mounted before json+auth, unchanged). - adapters/oem/src/routers/middlewares/index.ts: validateApiKeyOrSupergraphCredentials is already exported; just rewire mount points. validateAPIKey stays exported because /admin still uses it. - Update commands.test.ts to reflect new mount order if needed. - Add at least one test confirming /v1/alert accepts both admin Authorization AND the supergraph triple (no regression for existing admin callers). Out-of-scope: any other manufacturer-handler work — that's a separate task. Branch: havoc/bolt-1322-oem-v1-or-auth-widen Depends on: PR #12557 merging first (this builds on its middleware). Done when: lint+typecheck+tests pass locally; PR opened; CI green; standup-headlined. Self-link: see Slack DM 1781883984.255239 in BOLT-1322 thread for context.