fix: handle missing SDK authorization headers (#15050)

### What problem does this PR solve?

Closes #15048.

Several SDK session routes in `api/apps/sdk/session.py` called
`.split()` directly on `request.headers.get("Authorization")`. When
clients omitted the header, the handlers raised `AttributeError` before
returning the existing `Authorization is not valid!` response.

This PR centralizes SDK Authorization parsing in a small helper and
keeps the existing error response for missing, empty, or malformed
headers.

### Type of change

- [x] Bug Fix (non-breaking change which fixes an issue)

### Tests

- `ZHIPU_AI_API_KEY=dummy uv run --python 3.13 --group test pytest
test/testcases/test_http_api/test_session_management/test_session_sdk_routes_unit.py::test_sdk_session_routes_missing_authorization_unit
-q`
- `uv run --python 3.13 --group test ruff check api/apps/sdk/session.py
test/testcases/test_http_api/test_session_management/test_session_sdk_routes_unit.py`
- `python3 -m py_compile api/apps/sdk/session.py
test/testcases/test_http_api/test_session_management/test_session_sdk_routes_unit.py`
- `git diff --check`

test/testcases/test_http_api/test_session_management/test_session_sdk_routes_unit.py

@@ -1405,6 +1405,32 @@ def test_delete_agent_session_error_matrix_unit(monkeypatch):
     assert res["data"]["errors"] == ["Duplicate session ids: ok"]
 
 
+@pytest.mark.p2
+@pytest.mark.parametrize(
+    ("handler_name", "args"),
+    [
+        ("chatbot_completions", ("dialog-1",)),
+        ("chatbots_inputs", ("dialog-1",)),
+        ("agent_bot_completions", ("agent-1",)),
+        ("begin_inputs", ("agent-1",)),
+        ("ask_about_embedded", ()),
+        ("retrieval_test_embedded", ()),
+        ("related_questions_embedded", ()),
+        ("detail_share_embedded", ()),
+        ("mindmap", ()),
+    ],
+)
+def test_sdk_session_routes_missing_authorization_unit(monkeypatch, handler_name, args):
+    module = _load_session_module(monkeypatch)
+    monkeypatch.setattr(module, "request", SimpleNamespace(headers={}, args={"search_id": "search-1"}))
+    monkeypatch.setattr(module, "get_request_json", lambda: _AwaitableValue({}))
+
+    handler = inspect.unwrap(getattr(module, handler_name))
+    res = _run(handler(*args))
+
+    assert res["message"] == "Authorization is not valid!"
+
+
 @pytest.mark.p2
 def test_chatbot_routes_auth_stream_nonstream_unit(monkeypatch):
     module = _load_session_module(monkeypatch)