feat(standards): integrate auth-server via pinned spec (docs://spec) + auth recipe and template slice

- serve the pinned auth-server OpenAPI contract as the standards MCP resource docs://spec (no auth-server MCP bundle)
- add Auth Integration recipe (14) and wire it into the registry, prompts, index, and nav
- un-defer Auth Server in the library registry (spec/recipe pointers)
- ship the opt-in template auth slice: interfaces/auth/ (placeholder + mergeable bearerAuth security.yaml) and AUTH_SERVER/JWT_SERVER env
- rebuild bundle (13 modules, 44 components); template stays authless by default

standards/mcp/components.json

@@ -42,6 +42,12 @@
       "placeholder": "",
       "description": "Route registry: flat re-export of every handler namespace."
     },
+    {
+      "kind": "auth",
+      "path": "interfaces/auth/security.yaml",
+      "placeholder": "",
+      "description": "Mergeable bearerAuth security scheme + global security for openapi.yaml."
+    },
     {
       "kind": "test-model",
       "path": "tests/unit/test_item_models.py",