Preserve username-only URL auth

[lin-hongkuan]

Summary

get_auth_from_url() now keeps a URL username when the URL has no password component instead of dropping the username.

Why

A username-only URL authority still carries authentication information. Returning an empty auth tuple loses that information and differs from the behavior for URLs that include both username and password.

Tests

• python -m pytest tests/test_utils.py::test_get_auth_from_url tests/test_utils.py::test_prepend_scheme_if_needed tests/test_utils.py::test_urldefragauth -q
• git diff --check origin/main..HEAD

AI-assisted

Codex helped prepare this focused change. I reviewed the diff and ran the tests above before submitting.

[nateprewitt]

Hi @lin-hongkuan, do you have a concrete scenario where you've actually encountered this or is it something that Codex derived?

Given this code has been in place for ~15 years with billions of downloads and no one has hit this issue, we're talking about an extreme edge case. I agree this could be more tolerant but it's an arguably breaking change. Without a strong reason, I don't think we'd accept this in 2.x.

[nateprewitt]

Nevermind, I see this is an OpenClaw agent on the loose.