feat(openapi): document bearer auth on the 28 token-gated routes

The spec carried no security scheme, so generated clients/docs could not tell
which endpoints require a session token — e.g. /wallet/utxo/balance read as
public while its handler enforces auth via extract_user_id_from_token. Add a
`bearer_auth` HTTP/JWT scheme through a Modify addon and annotate every route
that resolves a session; auth-bootstrap, public username/key lookups, and
system routes stay open. Regenerated openapi.json (drift clean).

src/api/auth.rs

@@ -857,6 +857,7 @@ pub async fn logout(
 
 /// The authenticated user's own info.
 #[utoipa::path(
+    security(("bearer_auth" = [])),
     get,
     path = "/auth/me",
     responses(
@@ -1009,6 +1010,7 @@ pub struct NostrLinkResponse {
 /// shape but refuses every link, because it cannot yet prove the nonce was issued
 /// by this server and is unused.
 #[utoipa::path(
+    security(("bearer_auth" = [])),
     post,
     path = "/auth/nostr/link",
     request_body = NostrLinkRequest,