fix: keep server.py under the 750-line guard after auth-reject close

Move the close-on-reject decision into api.auth.check_auth_or_close so the
added lines land outside server.py, restoring it to 749 lines. Trim the
inline comment to a one-line docstring on the helper, per review feedback.

The rejected-write connection-close test now patches api.auth.check_auth
(the dependency the helper calls) instead of server.check_auth.

tests/test_rejected_write_connection_close.py

@@ -10,6 +10,7 @@ from typing import Any, cast
 
 
 def test_auth_rejected_write_closes_connection(monkeypatch):
+    import api.auth as auth
     import server
 
     handler = SimpleNamespace(
@@ -20,7 +21,7 @@ def test_auth_rejected_write_closes_connection(monkeypatch):
     monkeypatch.setattr(server, "reset_trusted_auth_request_state", lambda _handler: None)
     monkeypatch.setattr(server, "get_profile_cookie", lambda _handler: None)
     monkeypatch.setattr(server, "clear_request_profile", lambda: None)
-    monkeypatch.setattr(server, "check_auth", lambda _handler, _parsed: False)
+    monkeypatch.setattr(auth, "check_auth", lambda _handler, _parsed: False)
 
     def route_must_not_run(_handler, _parsed):
         raise AssertionError("route ran after auth rejection")