Security schemes: info-only schemes (basic, oauth2, openIdConnect, mutualTLS, cookie apiKey)

[t1]

Sub-issue of #12. Depends on #34 (infrastructure).

Scope: Documentation-only rows for browser-handled security schemes.

• http basic: "Basic authentication (handled by browser)"
• oauth2: flow type, authorization URL, token URL, scopes
• openIdConnect: discovery URL
• mutualTLS: "Mutual TLS (client certificate required)"
• cookie apiKey: cookie name, "handled by browser"

All use the auth badge but show descriptive text instead of an input field. No fetch integration needed.

Spec: docs/superpowers/specs/2026-04-10-issue-12-security-schemes-design.md

[t1]

Agent: starting work

Type: Feature
Summary: Add documentation-only rows for browser-handled security schemes (http basic, oauth2, openIdConnect, mutualTLS, cookie apiKey). These schemes render with auth badges but show descriptive text instead of input fields, since browsers handle them automatically.
Design decisions:

• Same auth badge pattern as apiKey/bearer but with descriptive text instead of input
• Each scheme type shows relevant metadata (flow URLs for OAuth2, discovery URL for OIDC, etc.)
• No fetch integration needed - browsers handle these automatically
  Acceptance criteria:
• http basic shows "Basic authentication (handled by browser)"
• oauth2 shows flow type, authorization URL, token URL, scopes
• openIdConnect shows discovery URL
• mutualTLS shows "Mutual TLS (client certificate required)"
• cookie apiKey shows cookie name and "handled by browser"
• All use auth badge (🔒 + scheme type) in warning color
  Files: OperationFragmentGenerator.java (add info-only auth field methods), new test specs + tests

[t1]

Agent: done

Commit: 39e66dc
Summary: Implemented info-only security scheme rows for browser-handled authentication. Added support for http basic, oauth2, openIdConnect, mutualTLS, and cookie apiKey. All render with auth badges (🔒 + scheme type) in warning color but show descriptive text instead of input fields since browsers handle these automatically.
Tests: Added 5 new test specs and tests that verify badge rendering and descriptive text for each info-only scheme type:

• http basic: "Basic authentication (handled by browser)"
• oauth2: flow type with authorization/token URLs
• openIdConnect: discovery URL
• mutualTLS: "Mutual TLS (client certificate required)"
• cookie apiKey: cookie name with "handled by browser"
  CI: ✅ passed