Align /token with RFC 6749 Pragma and Basic credential encoding

## Summary

Two small RFC 6749 gaps in the current `/token` contract:

1. **Token response caching** — OpenAPI declares `Cache-Control: no-store` on successful token responses, but not `Pragma: no-cache`. [RFC 6749 section 5.1](https://www.rfc-editor.org/rfc/rfc6749.html#section-5.1) requires both for responses that include tokens (or other sensitive values).

2. **Basic client authentication** — The `basicAuth` scheme describes API key id/secret as username/password, but does not state that each value is `application/x-www-form-urlencoded` encoded before `userid:password` and Base64, as required by [RFC 6749 section 2.3.1](https://www.rfc-editor.org/rfc/rfc6749.html#section-2.3.1). That encoding matters for secrets containing `:`, `@`, or other reserved characters. (`auth/readme.md` already notes this; OpenAPI should match.)

## Proposed fix

- Add `Pragma: no-cache` beside `Cache-Control: no-store` on `token-issued` (and align the auth doc example).
- Document the §2.3.1 form-encoding step in the `basicAuth` security scheme description.