feat(standards): integrate auth-server via pinned spec (docs://spec) + auth recipe and template slice

- serve the pinned auth-server OpenAPI contract as the standards MCP resource docs://spec (no auth-server MCP bundle)
- add Auth Integration recipe (14) and wire it into the registry, prompts, index, and nav
- un-defer Auth Server in the library registry (spec/recipe pointers)
- ship the opt-in template auth slice: interfaces/auth/ (placeholder + mergeable bearerAuth security.yaml) and AUTH_SERVER/JWT_SERVER env
- rebuild bundle (13 modules, 44 components); template stays authless by default

standards/src/lib/index.md

@@ -15,6 +15,8 @@ patterns, and the internal library catalog that agents consult while coding.
 - **Human-in-the-Loop** — guardrails and approvals inside automations.
 - **Infra Adapters** — how infrastructure connects without leaking into domain.
 - **Genericity Matrix** — what is library-backed, template-provided, or authored.
+- **Auth Integration** — consuming the shared auth-server service (spec-driven,
+  no auth code).
 - **Library Registry** — the catalog of internal libraries behind all of it.
 
 Read the **Wiki** for the philosophy and rationale; these pages are the