Make bearer-token transport a documented, tested auth path

The auth middleware already supports bearer tokens behind an `AllowBearer` flag that ships off, because the only client today is a browser reaching the API through Next.js and declaring a bearer scheme would advertise a transport the scaffold neither documents nor tests. The flag exists; the contract and the coverage do not (`docs/superpowers/specs/2026-08-31-auth-foundation-provider-abstraction-design.md`, *Deferred*).

Turning it on properly means declaring the scheme in the OpenAPI document, documenting when a project would want it, and testing the path — which matters as soon as a non-browser client exists, mobile being the obvious one.

Came out of reviewing the deferred sections of the existing specs.

Start with the deferred auth foundation spec and trace the auth middleware's existing AllowBearer flag. Inspect how the OpenAPI document declares authentication and how the current auth path is tested; done means the bearer scheme is declared, its intended use is documented, and the bearer path has coverage.

Written by the indexing model from the issue text.