[X6M-Work]

Fixes #1109.

Summary

WebArgsTornadoMultiDictProxy.__getitem__ reads values with self.data.get(key). For a tornado.httputil.HTTPHeaders, get() joins repeated headers with commas. For a multi-value key, the proxy then iterates over that string, so a List field receives the joined header split into characters:

headers = tornado.httputil.HTTPHeaders()
headers.add("works", "Prometheus Bound")
headers.add("works", "Prometheus Unbound")
parser.parse({"works": fields.List(fields.Str())}, request, location="headers")
# dev:     {'works': ['P', 'r', 'o', 'm', ..., ',', 'P', 'r', ...]}
# this PR: {'works': ['Prometheus Bound', 'Prometheus Unbound']}

Changes

• For multi-value keys, the proxy uses HTTPHeaders.get_list() when the data is an HTTPHeaders. Query, form and file arguments are already lists, so they are unchanged.
• Single-value fields keep the comma-joined value, which is how HTTP allows repeated headers to be combined.

Tests

The existing header tests build the request from a plain dict, which is why they did not catch this. Two new tests in TestHeadersArgs use a real HTTPHeaders, with a repeated header and with a single header. Both fail on dev.

pytest: 505 passed, 4 skipped. pre-commit run --all-files passes (ruff, mypy, blacken-docs, ...).

[sirosen]

I hesitated about this because, unlike the others, the fix is at least plausible on the surface.

But upon consideration, this PR violates our AI Policy and there's no need to entertain it further.