[roomote-roomote]

​Opened on behalf of @daniel-lxs. Follow up by mentioning @roomote-roomote, in the web UI, or in Telegram.

Related issue

Internal maintainer-requested correctness work; no issue opened.

Why this PR exists

• A maintainer explicitly invited this PR in the linked issue or discussion
• I am a maintainer / this is internal Roomote work

Entering Authorization or padded uppercase AUTHORIZATION shows a Scheme selector, but saving drops the selected Bearer/Token prefix. The header name is normalized while the prefix condition checks the raw casing.

What changed

Normalize the submitted header name once and use it for both the header and scheme condition. Standard lowercase Authorization and custom-header behavior stay unchanged. No new state, controls, dependencies, API or schema changes.

How it was tested

• Current develop actual form/API save persisted lowercase authorization with an empty prefix despite the visible Bearer choice. Case/whitespace payload regressions fail on that baseline.
• Tested head 32f9903dea9ee7acd11dd4e873535b8bcc83611b: real shared desktop mixed-case Bearer save, personal mobile padded-uppercase Token save, and custom X-API-Key empty-prefix control all persist the selected metadata through the local API/PostgreSQL. Each fixture was removed through the normal confirmation flow, then physically cleaned up; zero fixture rows remain.
• Fourteen focused shared/personal tests, web typecheck and full pre-push gates pass. Browser capture is unnecessary for an unchanged rendered dialog; the saved-prefix claim is proved by database readback, not screenshots.
• Only fake keys and example.com metadata were used; no external provider call or real-user message. This does not claim live provider parity or repair previously saved integrations.

Checklist

• The PR title follows the repo convention: [Fix], [Feat], [Improve], [Refactor], [Docs], or [Chore] followed by a user-facing description
• This PR is small and scoped to one change
• pnpm lint and pnpm check-types pass locally
  • Normal fast equivalents passed via the full pre-push suite; changed files formatted.
• I added tests or included a clear manual validation note above
• I removed secrets, tokens, private keys, and customer data from code, logs, and screenshots
• If this change should appear in the changelog, I ran pnpm changeset
  • Narrow serialization fix; no standalone changeset.

Related PRs

• Shared agent guidance read recovery — independent; no dependency.
• Discord checkpoint session isolation — independent; no dependency.
• Keyless New Session shortcut events — independent; no dependency.
• API-key setup retry metadata — separate form fix in different hunks; neither depends on the other.

[roomote-community]

No code issues found. See task

Reviewed header normalization, scheme serialization, shared/personal form usage, API validation, and regression coverage. Lint, typecheck, and Knip checks passed; tests and Docker build were still running when checked.

_{Reviewed 32f9903}