simulator: authorize_account returns full master capabilities regardless of the authorizing key

[goanpeca]

Area: B2Simulator (src/simulator/index.ts, authorize)

The auth response returns a fixed full capability set in apiInfo.storageApi.allowed.capabilities for every credential (except when a previously-created key's exact Basic header matches). A key created with, say, only listFiles still reports the full master set, which drives B2Client.hasCapabilities.

Impact: client-side capability-gating logic is tested against an over-broad cap list.

Expected: always derive the response allowed capabilities (and bucket/prefix restrictions) from the authorizing key.

Acceptance criteria:

• restricted key reports only its granted capabilities
• bucket/namePrefix restriction reflected in allowed
• regression tests

Source: post-0.1.0 audit.

[goanpeca]

Current-state refresh from simulator parity review:

The narrow issue described here appears partially/stale in current code: authorize() now uses the matching application key when the Basic auth header maps to a simulator-created key and reflects that key's capabilities/bucket/namePrefix in the auth response. The broader remaining parity gap is strict-auth scope enforcement across handlers, now tracked in #110.

Before closing this issue, add or confirm a regression test that authorizing with a restricted simulator-created key reports only that key's granted capabilities and scope.