Fix CAS ticket validation in Cloudflare Workers

[DIodide]

The deployed CAS callback returned 502 because Cloudflare Workers rejects fetch with redirect: "error" before making a request. Node's fetch accepts this value, so the unit tests did not catch the runtime difference.

Use redirect: "manual" and reject non-2xx responses, preserving the requirement that validation never follows redirects. Add a redirect-response regression case.

Validation: all 30 auth tests and TypeScript pass. The bundled auth handler was also exercised in the actual Workers runtime with Miniflare: live Princeton CAS rejects an invalid ticket as expected, a mocked successful CAS response creates a readable signed session, and a mocked redirect is rejected without being followed. CI runs the production build.