Build or decode a Basic-auth header. Reminder: it's just base64 — not encryption. Use test credentials only.