feat(story-2.4): AsyncClient.__init__ accepts auth= and tracks _user_middleware/_auth

Adds the `auth: AuthValue = None` keyword param. Coerces via
_normalize_auth and appends the resulting middleware (if any) at the END
of the user-supplied middleware list — so it runs just before the
transport.

Introduces two new private attrs on AsyncClient:
- _user_middleware: the user's tuple, EXCLUDING the auth middleware
- _auth: the raw AuthValue (so with_options can recompose)

ClientConfig.middleware continues to hold the COMPOSED list (what
actually runs), keeping the existing wiring contract.

Three new construction tests verify: no auth → empty composed; string
auth → 1-element composed; user middleware + auth → 3-element composed
with user entries at positions 0,1 and auth at position 2.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: lesnik512

src/httpware/client.py

@@ -5,6 +5,7 @@
 import typing
 from collections.abc import Mapping, Sequence
 
+from httpware._internal.auth import AuthValue, _normalize_auth
 from httpware._internal.chain import compose
 from httpware.config import ClientConfig, Limits, Timeout
 from httpware.decoders import ResponseDecoder
@@ -52,6 +53,8 @@ class AsyncClient:
     _transport: Transport
     _dispatch: Next
     _owns_transport: bool
+    _user_middleware: tuple[Middleware, ...]
+    _auth: AuthValue
 
     def __init__(
         self,
@@ -64,12 +67,23 @@ def __init__(
         transport: Transport | None = None,
         decoder: ResponseDecoder | None = None,
         middleware: Sequence[Middleware] | None = None,
+        auth: AuthValue = None,
     ) -> None:
         normalized_timeout = _normalize_timeout(timeout)
         resolved_limits = limits or Limits()
-        resolved_transport: Transport = transport or Httpx2Transport(limits=resolved_limits, timeout=normalized_timeout)
+        resolved_transport: Transport = transport or Httpx2Transport(
+            limits=resolved_limits, timeout=normalized_timeout
+        )
         resolved_decoder = decoder or PydanticDecoder()
-        resolved_middleware = tuple(middleware) if middleware is not None else ()
+        resolved_user_middleware: tuple[Middleware, ...] = (
+            tuple(middleware) if middleware is not None else ()
+        )
+        resolved_auth_middleware = _normalize_auth(auth)
+        composed_middleware: tuple[Middleware, ...] = (
+            resolved_user_middleware
+            if resolved_auth_middleware is None
+            else (*resolved_user_middleware, resolved_auth_middleware)
+        )
 
         self._config = ClientConfig(
             base_url=base_url,
@@ -78,11 +92,13 @@ def __init__(
             timeout=normalized_timeout,
             limits=resolved_limits,
             decoder=resolved_decoder,
-            middleware=resolved_middleware,
+            middleware=composed_middleware,
         )
         self._transport = resolved_transport
-        self._dispatch = compose(resolved_middleware, resolved_transport)
+        self._dispatch = compose(composed_middleware, resolved_transport)
         self._owns_transport = True
+        self._user_middleware = resolved_user_middleware
+        self._auth = auth
 
     @classmethod
     def from_url(cls, base_url: str, **kwargs: object) -> "AsyncClient":

tests/test_client_construction.py

@@ -76,3 +76,37 @@ def test_construction_does_not_create_httpx2_client() -> None:
     # Httpx2Transport stores `_client` lazily; until first call, _client is None.
     # The attribute is private; we check it via getattr to keep the test resilient.
     assert getattr(client._transport, "_client", "missing") is None
+
+
+def test_init_no_auth_means_no_auth_middleware() -> None:
+    transport = RecordedTransport()
+    client = AsyncClient(transport=transport)
+    assert client._config.middleware == ()
+    assert client._auth is None
+    assert client._user_middleware == ()
+
+
+def test_init_with_string_auth_appends_bearer_middleware() -> None:
+    transport = RecordedTransport()
+    client = AsyncClient(transport=transport, auth="tok")
+    assert len(client._config.middleware) == 1
+    assert isinstance(client._config.middleware[0], Middleware)
+    assert client._auth == "tok"
+    assert client._user_middleware == ()
+
+
+def test_init_with_user_middleware_plus_auth() -> None:
+    class _M:
+        async def __call__(self, request, next) -> Response:  # noqa: A002, ANN001
+            return await next(request)
+
+    m1 = _M()
+    m2 = _M()
+    transport = RecordedTransport()
+    client = AsyncClient(transport=transport, middleware=[m1, m2], auth="tok")
+    _expected_len = 3
+    assert len(client._config.middleware) == _expected_len
+    assert client._config.middleware[0] is m1
+    assert client._config.middleware[1] is m2
+    # The third entry is the auth middleware; identity-test that user_middleware excludes it.
+    assert client._user_middleware == (m1, m2)