fix: use auth.env for bundle resolution instead of client-controlled query param

Prefer the authenticated API key's environment over the raw env query
parameter when resolving assignment rules. Falls back to query param
only if auth.env is not set (shouldn't happen with require_api_key).

Author: acartag7

src/edictum_server/routes/stream.py

@@ -79,7 +79,7 @@ async def stream(
             agent_id,
             agent_tags=parsed_tags,
             agent_provided_bundle=None,
-            env=env,
+            env=auth.env or env,
         )
         effective_bundle = resolved