feat(standards): integrate auth-server via pinned spec (docs://spec) + auth recipe and template slice

- serve the pinned auth-server OpenAPI contract as the standards MCP resource docs://spec (no auth-server MCP bundle)
- add Auth Integration recipe (14) and wire it into the registry, prompts, index, and nav
- un-defer Auth Server in the library registry (spec/recipe pointers)
- ship the opt-in template auth slice: interfaces/auth/ (placeholder + mergeable bearerAuth security.yaml) and AUTH_SERVER/JWT_SERVER env
- rebuild bundle (13 modules, 44 components); template stays authless by default

build.py

@@ -187,6 +187,8 @@ _TEMPLATE_COMPONENTS: list[dict[str, str]] = [
      "description": "Thin HTTP handlers bound to operationIds."},
     {"kind": "openapi-routes", "path": "interfaces/openapi.py", "placeholder": "",
      "description": "Route registry: flat re-export of every handler namespace."},
+    {"kind": "auth", "path": "interfaces/auth/security.yaml", "placeholder": "",
+     "description": "Mergeable bearerAuth security scheme + global security for openapi.yaml."},
     {"kind": "test-model", "path": "tests/unit/test_item_models.py", "placeholder": "resource",
      "description": "Unit test for the resource model."},
     {"kind": "test-routes", "path": "tests/integration/test_item_routes.py", "placeholder": "resource",