feat: declare security schemes in the OpenAPI document #89

Symptom

The app declares authentication as plain optional headers (Header(None) for Authorization and X-Api-Key), so the generated docs/api/openapi.json has no components.securitySchemes and no security array on any operation. Every OpenAPI consumer, including generated clients and Swagger UI, presents every endpoint as anonymous, including the operator routes gated by #39.

Reproduction

$ uv run python -c "from ad_seller.interfaces.api.main import app; s=app.openapi(); ops=[o for p in s['paths'].values() for m,o in p.items() if m in ('get','post','put','patch','delete')]; print('securitySchemes' in s.get('components',{}), len(ops), sum(1 for o in ops if o.get('security')))"
False 88 0

No security schemes declared, 88 operations, none carrying a security requirement. The operator-only routes gated in code by deps._require_operator_api_key_record are indistinguishable from public reads in the document.

Environment

seller-agent main at 8dfd5e0 (after #78), installed with uv sync --locked: Python 3.12.12, fastapi 0.139.0, iab-agentic-primitives==0.5.1. macOS 26.6. The document was built in-process with app.openapi(), the same call scripts/generate_openapi.py makes.

Expected

Declare two schemes, API key in X-Api-Key and HTTP bearer, and attach security to the operator-gated and buyer-verified operations. FastAPI's APIKeyHeader and HTTPBearer dependencies produce this without hand-editing the document.

Regenerating the document cannot fix this; it reports the app faithfully. Found while regenerating openapi.json; pre-existing on main at 8dfd5e0.