security: remove unsafe direct DID auth bypass

src/main.rs

@@ -283,10 +283,6 @@ fn extract_did(headers: &HeaderMap) -> Option<String> {
     let auth = headers.get("authorization")?.to_str().ok()?;
     let token = auth.strip_prefix("Bearer ")?;
 
-    if token.starts_with("did:") {
-        return Some(token.to_string());
-    }
-
     // Decode JWT payload: prefer "sub" (service auth from PDS proxy), fallback to "iss"
     let parts: Vec<&str> = token.split('.').collect();
     if parts.len() == 3 {