Align OpenAPI security with open and mixed TEA servers

## Summary

`auth/readme.md` describes open and mixed servers, but the OpenAPI document currently declares global `security: Bearer` only. The reusable `401` response is also unused on resource operations, and there is no `403`.

## Suggestion

1. Global security as Bearer **or** empty (`{}`), so anonymous calls are representable.
2. Declare `401` / `403` on resource operations (runtime still decides which endpoints actually require a token).
3. Clarify that `/token`’s empty security requirement is for alternate client authentication (for example, mutual TLS, `private_key_jwt`, or credentials in the request body), **not** anonymous `client_credentials`.
4. Note that servers may conceal unauthorized resources with `404`.