feat(standards): integrate auth-server via pinned spec (docs://spec) + auth recipe and template slice

- serve the pinned auth-server OpenAPI contract as the standards MCP resource docs://spec (no auth-server MCP bundle)
- add Auth Integration recipe (14) and wire it into the registry, prompts, index, and nav
- un-defer Auth Server in the library registry (spec/recipe pointers)
- ship the opt-in template auth slice: interfaces/auth/ (placeholder + mergeable bearerAuth security.yaml) and AUTH_SERVER/JWT_SERVER env
- rebuild bundle (13 modules, 44 components); template stays authless by default

standards/lib/13_library_registry/index.html

@@ -11,7 +11,7 @@
       
       
       
-        <link rel="prev" href="../12_genericity_matrix/">
+        <link rel="prev" href="../14_auth_integration/">
       
       
       
@@ -462,6 +462,28 @@
       
   
   
+  
+  
+    <li class="md-nav__item">
+      <a href="../14_auth_integration/" class="md-nav__link">
+        
+  
+  
+  <span class="md-ellipsis">
+    Auth Integration
+    
+  </span>
+  
+
+      </a>
+    </li>
+  
+
+    
+      
+      
+  
+  
     
   
   
@@ -734,9 +756,9 @@ can read a library's full API by connecting to its MCP and reading
 <tr>
 <td>Auth Server</td>
 <td><em>(service)</em></td>
-<td>Central identity service (register/login/me/introspect)</td>
+<td>Central identity service (register/login/me/logout/introspect)</td>
 <td>building auth endpoints yourself</td>
-<td><em>(deferred)</em></td>
+<td>spec: <code>docs://spec</code></td>
 </tr>
 </tbody>
 </table>
@@ -786,15 +808,20 @@ can read a library's full API by connecting to its MCP and reading
 <h2 id="discovery">Discovery</h2>
 <p>A single <strong>standards MCP</strong> exposes <code>find_library(capability)</code>, which returns the
 matching library, its import name, its "use instead of" guidance, and its MCP
-endpoint. Query it before writing any infrastructure.</p>
+endpoint (or, for the auth-server service, a spec pointer). It also serves the
+pinned auth-server OpenAPI contract at <code>docs://spec</code>. Query it before writing
+any infrastructure.</p>
 <h2 id="notes">Notes</h2>
 <ul>
 <li><strong>Hexa</strong> is a full library with its own MCP server on <code>:8008</code>: read
   <code>docs://index</code>, <code>docs://nav</code>, and <code>docs://modules/{module}</code> (e.g.
   <code>docs://modules/hexa.container</code>) to discover the DI surface — <code>build(cls, *,
   instances, config)</code> and the <code>PortNode</code> model.</li>
-<li><strong>Auth Server</strong> is deferred: it has no <code>pyproject.toml</code>/importable package and
-  no MCP bundle. Do not reach for it yet; <code>py-jwt</code> covers token primitives.</li>
+<li><strong>Auth Server</strong> is a <strong>service</strong>, not an importable library: it has no MCP
+  bundle by design. Read its client contract from the pinned OpenAPI document
+  via <code>docs://spec</code> and wire it by declaring a <code>bearerAuth</code> security scheme in
+  the app's own spec (see <strong>Auth Integration</strong>); <code>py-jwt</code> covers the
+  low-level token path.</li>
 <li>Library MCP servers expose <strong>documentation resources</strong> (not executable tools):
   they tell an agent the available API surface so it does not invent code.</li>
 </ul>