feat(standards): integrate auth-server via pinned spec (docs://spec) + auth recipe and template slice

- serve the pinned auth-server OpenAPI contract as the standards MCP resource docs://spec (no auth-server MCP bundle)
- add Auth Integration recipe (14) and wire it into the registry, prompts, index, and nav
- un-defer Auth Server in the library registry (spec/recipe pointers)
- ship the opt-in template auth slice: interfaces/auth/ (placeholder + mergeable bearerAuth security.yaml) and AUTH_SERVER/JWT_SERVER env
- rebuild bundle (13 modules, 44 components); template stays authless by default

standards/mcp/nav.json

@@ -54,6 +54,11 @@
     "resource": "docs://modules/library_registry",
     "title": "Library Registry"
   },
+  {
+    "module": "auth_integration",
+    "resource": "docs://modules/auth_integration",
+    "title": "Auth Integration"
+  },
   {
     "module": "index",
     "resource": "docs://modules/index",