fix(sdk-api): guard v1 auth path against undefined accessToken in testnet

[bitgo-ai-agent-dev]

What

• In `_sendRequestWithHmac` (modules/sdk-api/src/bitgoAPI.ts), moved the `this._token &&` guard outside the v1-auth condition so `req.forceV1Auth = true` can no longer bypass the token check.
• Old condition: `(this._token && A && B) || req.forceV1Auth` — when token is undefined and `forceV1Auth` is set, the expression is truthy, causing `Authorization: 'Bearer undefined'` to be sent.
• New condition: `this._token && (A && B || req.forceV1Auth)` — the v1 path is only entered when a token is actually present.
• Added two unit tests asserting the header is never `'Bearer undefined'` when `accessToken` is not provided.

Why

• When `BitGoAPI` is constructed with `accessToken: process.env.TESTNET_ACCESS_TOKEN` and the environment variable is not set, `accessToken` is `undefined`. In the v1 auth path, JavaScript string concatenation converts this to `'Bearer undefined'`, which the server rejects with an "undefined access token" error in testnet.

Test plan

• New unit tests in `modules/sdk-api/test/unit/bitgoAPI.ts` cover both normal authenticate and `forceV1Auth` paths with an undefined accessToken
• Existing SDK-API unit tests continue to pass

Ticket: WCI-1213